Microsoft Introduces KMS Hardware-Secured for Windows Server Activation

Microsoft has introduced KMS Hardware-Secured, an upcoming enhancement to Windows Server activation that utilizes Trusted Platform Module (TPM)-based attestation to validate Key Management Service (KMS) hosts before they can activate Windows devices.

Announced in a July 2022 Windows IT Pro Blog post, this initiative addresses risks related to spoofed, cloned, or otherwise untrusted KMS infrastructure. The capability aims to shift KMS activation from a software-only trust model to one based on verifiable hardware identity.

Microsoft Introduces KMS Hardware-Secured

KMS has long allowed organizations to activate large fleets of Windows devices through internally managed activation hosts.

However, traditional KMS hosts primarily depend on software configuration, which increases vulnerability to credential theft, host cloning, configuration tampering, and illicit activation services.

Microsoft stated that KMS Hardware-Secured will require hosts in upcoming Windows Server releases to demonstrate that they are running on verified and uncompromised hardware before issuing activation licenses to enterprise clients.

The architecture relies on TPM attestation, where the TPM functions as a hardware root of trust and generates cryptographic evidence about the host and its platform state.

Microsoft validates this evidence before authorizing the server to operate as a KMS activation endpoint. This verification process is designed to ensure three safeguards: confirmation of the host’s hardware identity, validation that the underlying platform has not been tampered with, and protection for activation secrets by binding them to trusted hardware.

Under this new model, an organization’s Windows clients will receive activation services from a validated KMS host rather than from a server whose configuration could potentially be copied or spoofed.

Microsoft indicated that this change can help reduce activation misuse, limit licensing and compliance risks, and create a more robust foundation for future activation security requirements.

Unlike legacy KMS deployments, which do not have mandatory hardware prerequisites, KMS Hardware-Secured deployments will require TPM support and attestation capability.

Administrators should start by inventorying all physical KMS hosts and confirming that the servers are certified for Windows Server through the Windows Server Catalog.

They must also ensure that TPM hardware is installed and enabled. Microsoft has stated that guidance for virtualized KMS host environments will be shared in future blog posts. This suggests that organizations relying on virtual KMS infrastructure should monitor forthcoming implementation details closely.

IT teams can validate TPM support through an elevated PowerShell session using the following command:

Get-TpmSupportedFeature -FeatureList "Key Attestation"

A successful result displaying “Key Attestation” indicates that the server supports the TPM attestation capability required for KMS Hardware-Secured.

Organizations should identify any hardware gaps, plan upgrades where necessary, communicate readiness plans across infrastructure teams, and stay updated on Microsoft’s enforcement timeline.

Beginning in August 2022, Windows Server 2022 will display readiness messages to help administrators determine whether a KMS host meets the hardware-based security requirements.

The `slmgr /dlv` command will indicate eligibility or noncompliance, while warning events will appear under Applications and Services Logs > Key Management Service.

Microsoft has stated that TPM attestation will become mandatory for KMS Hardware-Secured activation with the next Windows Server Long-Term Servicing Channel (LTSC) release, making early assessment essential for organizations managing large Windows environments.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.