Microsoft is using the TPM chip required for Windows 11 to crack down on KMS activation piracy

Q: When does Microsoft plan to make TPM-based attestation mandatory for KMS in Windows Server?

Microsoft will make TPM-based attestation mandatory starting with the next Windows Server release. Microsoft is beginning to push readiness notifications to Windows Server 2025 users from August 2026 to give organizations time to prepare.

Q: What specific checks does TPM-based attestation perform on a KMS host before allowing activations?

TPM-based attestation first verifies the hardware identity of the KMS host, confirming Microsoft has recognized the server as a legitimate physical device. It then checks that the host has not been tampered with. Only after passing both checks, via cryptographic verification through the TPM chip, is the KMS server permitted to handle activation requests.

Q: How does TPM-based attestation make spoofed or emulated KMS servers harder to use for piracy?

TPM-based attestation forces KMS hosts to prove a recognized physical hardware identity and show they have not been tampered with before they can handle activation requests. The cryptographic verification is performed via the TPM chip, which is considerably harder to fake than the software-level checks that spoofed or emulated KMS servers have been bypassing.

TPM attestation verifies KMS host hardware identity before allowing activation, though pirates have already responded with a new TSforge method.

VIEW GALLERY - 3

Hassam Nasir

Tech Reporter

Published Jul 26, 2026 5:50 PM CDT

1 minute & 30 seconds read time

TL;DR: Microsoft will require TPM-based attestation for KMS hosts starting with the next Windows Server release, verifying a server's hardware identity and integrity via the TPM before allowing activations; the feature becomes mandatory and readiness notices begin August 2026, while pirates have countered with a TSforge Activation method.

Voice: Hassam NasirSpeed

0:00 / --:--

Microsoft is putting the TPM chip it requires for Windows 11 to another use. The company has announced TPM-based attestation, a new security layer for Key Management Service (KMS), the activation system enterprises use to license Windows across large fleets of devices.

Starting with the next Windows Server release, the feature will become mandatory, and Microsoft is beginning to push readiness notifications to Windows Server 2025 users from August 2026 to give organizations time to prepare.

KMS has been a persistent target for abuse. Pirates have long spun up fake KMS servers that mimic legitimate Microsoft activation infrastructure, effectively tricking Windows into believing it has been properly licensed. The Online KMS method used by the Massgrave collective, for example, keeps activations alive by periodically contacting a spoofed server every six months. TPM-based attestation is designed to make that approach significantly more difficult.

The new system works in three steps. First, it verifies the hardware identity of the KMS host, confirming Microsoft has recognized the server as a legitimate physical device. Second, it checks that the host has not been tampered with. Only after passing both checks is the KMS server permitted to handle activation requests from client devices. The cryptographic verification runs through the TPM chip, making it considerably harder to fake than the software-level checks that existing piracy tools have been bypassing for years.

However, pirates have already responded by releasing a new method called TSforge Activation, which reportedly targets Microsoft's DRM architecture more broadly rather than relying on KMS emulation at all. The move is primarily aimed at enterprise environments and affects the KMS activation path specifically.

Frequently Asked Questions

TweakBot answers common questions about this news using TweakTown's own coverage from this page and related content from our archive. Tap a question to reveal the answer, or type your own below.

Question #1

When does Microsoft plan to make TPM-based attestation mandatory for KMS in Windows Server?

Question #2

Which versions or releases of Windows Server and client Windows are affected by this TPM attestation requirement?

The TPM attestation will be mandatory starting with the next Windows Server release, and Microsoft is sending readiness notifications to Windows Server 2025 users beginning August 2026. The article says the change affects the KMS activation path and notes TPM became synonymous with Windows 11 compatibility, but it does not list specific client Windows releases beyond that.

Answered

Question #3

What specific checks does TPM-based attestation perform on a KMS host before allowing activations?

Question #4

How does TPM-based attestation make spoofed or emulated KMS servers harder to use for piracy?

Have a question not listed here? Ask below and TweakBot will answer it.

That said, many users have historically relied on KMS emulation tools for personal activations, and those methods will become increasingly unreliable as the new requirements take hold. It also means the same TPM requirement that became synonymous with Windows 11 compatibility is now playing a direct role in Microsoft's licensing enforcement strategy, a possibility critics raised when the requirement was first introduced.