Microsoft posted a routine security update to its Windows IT Pro blog on July 22. By the weekend, headlines were describing the end of pirated Windows 11.
The post introduces KMS Hardware-Secured, a feature that requires corporate activation servers, not personal computers, to prove their identity through a TPM security chip before issuing a Windows license. Nothing changes for anyone running Windows at home, regardless of how their copy got activated. Nine months earlier, Microsoft closed a different activation loophole and watched the same panic cycle unfold, and the administrators left with actual work this time are the ones running virtual KMS servers, a group Microsoft still has not given a rulebook.
A Security Check Built for Servers, Not Desktops
Large organizations do not activate Windows one PC at a time. They run a Key Management Service host, or KMS, on their own network, and every machine that joins checks in with that host to receive its activation automatically. It is efficient, and until now a KMS host has proven its identity only through software configuration, information that is simple to copy.
Microsoft says attackers have been doing exactly that: standing up cloned or fake KMS hosts inside corporate networks that license machines nobody paid for, creating a compliance problem for the company being impersonated. The fix, described in a post on Microsoft’s Windows IT Pro blog, forces the host itself to prove its hardware identity through TPM attestation before it can issue a single license.
The Trusted Platform Module, or TPM, is the small security chip built into most modern motherboards. It can cryptographically confirm what hardware it is running on and whether that hardware has been altered since. A KMS host now has to pass both checks: prove it is the machine Microsoft thinks it is, and prove nothing about that machine changed afterward. Fail either one, and it loses the ability to activate anything.
The Same Panic Played Out Nine Months Ago
This is not the first time Microsoft has tightened Windows activation only to watch the internet assume the worst. In November 2025, cumulative updates quietly closed KMS38, an offline trick that abused a Windows upgrade helper file to fake an activation expiration date decades in the future. Pirate-tool maintainers noticed within days. Microsoft never issued a dedicated announcement naming piracy directly, and the fix arrived buried inside a normal patch cycle.
That closure primed expectations for a bigger move. When the KMS Hardware-Secured post appeared on July 22, readers had already been told to expect Microsoft’s next step against piracy. The gap between what actually changed and what got reported has now opened twice in less than a year.
- November 2025: Cumulative updates quietly close the file-based trick behind KMS38, ending a popular offline activation method.
- July 22, 2026: Microsoft’s Windows IT Pro blog announces KMS Hardware-Secured, tying KMS host activation to TPM attestation.
- That weekend: Headlines across the tech press recast the announcement as an imminent crackdown on pirated Windows 11.
- August 2026: Windows Server 2025 begins showing readiness notifications on KMS hosts, with no enforcement attached yet.
- No date set: TPM attestation becomes mandatory only in the next Windows Server Long-Term Servicing Channel release.
Both rounds targeted server infrastructure. Both times, headlines told individual users to worry.
Four Activation Methods, One Real Target
Windows activation runs on more than one track, and KMS Hardware-Secured only touches one of them.
| Activation Method | What It Verifies | Status as of July 2026 | Who Feels It |
|---|---|---|---|
| KMS Hardware-Secured | TPM attestation of the KMS host’s identity and integrity | Readiness alerts from August 2026; mandatory in the next Server LTSC release | Enterprise IT running genuine KMS servers |
| KMS38 | Nothing; exploited an upgrade-helper file to fake a distant expiration date | Closed in Microsoft’s November 2025 cumulative updates | Pirates who used that specific trick, now defunct |
| Local KMS emulator | Nothing; the “server” is fake software running on the same PC | Unaffected, since no genuine KMS host is ever contacted | Most home users running pirated Windows today |
| TSforge and HWID activation | Targets Microsoft’s licensing service directly, bypassing KMS entirely | Unaffected by this change | Users of the newest activation scripts |
The three methods left untouched are exactly the ones running on most pirated consumer installs today.
Piracy Tools Already Moved Past KMS
The activation scripts most commonly used to pirate Windows today, including ones with the letters KMS in their own name, do not contact a real KMS host at all. They launch a fake server on the same PC, one that approves any request it receives, and nothing in that setup is capable of performing a TPM check.
WindowsLatest reported that current tools built around HWID activation and the newer TSforge method skip KMS servers entirely, targeting Microsoft’s broader licensing architecture instead. A hardware attestation defense built around KMS arrives after part of the piracy scene had already stopped needing KMS at all.
This is not new in spirit. Microsoft has previously pulled instructions for bypassing its TPM checks from its own support documentation, and the requirement that Windows 11 clients have a working TPM to install at all has already forced plenty of workarounds on older hardware.
Do Virtual KMS Hosts Need a TPM Too?
Nobody knows for certain yet. Microsoft’s July 22 post sets clear rules for physical KMS hosts: certification in the Windows Server Catalog and a TPM installed and enabled in firmware. For virtual KMS hosts, arguably the more common enterprise setup, Microsoft says separate guidance is still coming, with no date attached.
Modern hypervisors, including Hyper-V, already support attaching a virtual TPM to individual virtual machines, but a vTPM alone may not satisfy the new check on its own. A virtual machine ultimately borrows its trust from the hardware underneath it, so the attestation chain may need to account for the physical host’s own TPM and Secure Boot state as well.
Physical hosts already face a documented compliance clock; the deadline now facing Windows Server IT admins is drawing attention inside enterprise IT circles. Virtualized hosts remain the unresolved half of the same story, and Microsoft has said only that more detail is coming later.
Checking Whether Your Server Is Ready
Administrators do not have to guess. Microsoft has already published the commands that show whether a given host qualifies.
- Run
slmgr /dlvon the KMS host to see its current readiness message. - Open Event Viewer and check Applications and Services Logs, then Key Management Service, for the same status.
- Run
Get-TpmSupportedFeature -FeatureList "Key Attestation"in an administrator PowerShell session; a response naming Key Attestation confirms the hardware supports key attestation.
Microsoft has not named a date for when any of this becomes mandatory. Until the next Long-Term Servicing Channel release ships, KMS hosts of every kind keep working exactly as they do now.
Frequently Asked Questions
Does KMS Hardware-Secured affect a pirated Windows 11 license on a home PC?
No. The feature checks a corporate KMS host’s TPM, and a home PC, pirated or not, never contacts a genuine KMS server in the way this change targets. Most pirated consumer installs run their own fake local activation server, which has no TPM check to fail in the first place.
What is the difference between KMS and MAK activation?
A Multiple Activation Key, or MAK, activates a single device once against a pool of activations Microsoft tracks centrally, either online or by phone, with no ongoing server needed afterward. KMS instead requires a device to periodically check back in with a host on the local network, which is what makes the host itself worth attacking.
What happens if a KMS client cannot reach its host?
Activations are not permanent. A client that cannot check back in with its KMS host on a recurring basis eventually reverts to a warning state, similar to what happens on an unactivated copy of Windows, until it can reconnect.
Which Windows Server version gets KMS Hardware-Secured first?
Windows Server 2025 is first in line, gaining the readiness notifications starting in August 2026. Full enforcement waits for the next Long-Term Servicing Channel release, and Microsoft has not attached a date to that yet.
Can a virtual machine’s vTPM satisfy the new TPM attestation check?
That is still unresolved. Hypervisors like Hyper-V can already attach a virtual TPM to a VM, but Microsoft has not confirmed whether a vTPM alone will pass hardware-secured attestation, since the underlying physical host’s own TPM and Secure Boot state may also factor into the check.
Do organizations need to buy new hardware for this?
Usually not. Most business hardware sold in recent years already ships with a TPM 2.0 chip, the same requirement Microsoft enforces for installing Windows 11 on older hardware. For most organizations this is a matter of certification and configuration rather than a purchase.
