System administrators will soon see new hardware security alerts when they manage Windows Server 2025’s activation service. Starting in August 2026, Microsoft is rolling out readiness checks that flag whether a Key Management Service (KMS) host can support a coming mandatory shift: TPM-based attestation for hardware-secured activation. The move, announced in a Windows IT Pro Blog post on July 22, gives IT teams a multi-year window to inventory and upgrade servers before the next Windows Server Long-Term Servicing Channel (LTSC) release makes the requirement binding.

A Hardware-Enforced Identity for KMS Hosts

KMS is the enterprise activation workhorse that allows organizations to activate Windows clients and servers internally without each device phoning home to Microsoft. Traditionally, a KMS host’s identity has been software-defined—a configuration that can, in theory, be cloned or spoofed, opening doors to activation abuse. The new model ties that identity to a physical Trusted Platform Module (TPM) chip, forcing the server to prove it is running on approved, uncompromised hardware before it can activate other devices.

Microsoft is calling this enhancement “KMS Hardware-Secured.” It alters three fundamental pieces of the activation puzzle:

  • Host identity – Instead of a configuration file that could be copied, the TPM provides cryptographic proof tied to the specific server hardware.
  • Protection of activation material – Secrets used during activation are bound to the hardware, reducing the risk of theft or reuse on a rogue KMS host.
  • Future compliance – TPM attestation will be mandatory for hardware-secured activation in the next LTSC release, making today’s readiness checks a critical planning tool.

Initially, the new checks will appear as informational messages only. When you run slmgr /dlv on a Windows Server 2025 KMS host after the August 2026 update, you’ll see one of two status lines:

  • This device is eligible to serve as a KMS host with hardware-based security.
  • This device does not meet the requirements for using KMS host with hardware-based security.

Warnings will also land in the Event Viewer under Applications and Services Logs > Key Management Service. No immediate action is forced—existing KMS deployments continue working as before—but the messages act as a countdown to the next LTSC release, when unsupported hosts will no longer be able to serve the hardware-secured activation model.

The Timeline You Need to Know

Two dates matter for IT planning:

  • August 2026 – Windows Server 2025 receives the KMS Hardware-Secured readiness messaging. Admins can begin auditing their KMS hosts.
  • Next Windows Server LTSC release – TPM attestation becomes a hard requirement for hardware-secured KMS activation. Microsoft has not published an exact release date, but LTSC cadences historically run three to four years, putting a likely window around 2027–2028.

The gap between the two gives organizations plenty of runway to budget, replace, or reconfigure unsupported hardware, provided they start the inventory process early.

Practical Impact for IT Administrators

This change touches only organizations that rely on physical KMS hosts. If your entire activation infrastructure runs inside virtual machines, the impact is muted for now—Microsoft hasn’t yet released equivalent guidance for virtualized hosts, though that is expected in future updates. For everyone else, the most immediate task is discovering which servers will fall short.

For Enterprise Admins

  • Inventory first – Document every physical server currently acting as a KMS host. Note its make, model, and TPM configuration.
  • Check certification – Verify each server appears in the Windows Server Catalog as certified for the version of Windows Server it runs. Uncertified hardware is unlikely to meet the new bar.
  • Validate TPM support – The TPM must be present, enabled, and capable of key attestation. A simple PowerShell command (covered below) confirms this.
  • Budget for replacement – Servers that fail the readiness check won’t be viable as hardware-secured KMS hosts in the next LTSC. Start scoping replacements now rather than scrambling during the next upgrade cycle.

For Smaller Shops and MSPs

Even small businesses that run a single KMS host on aging server hardware need to pay attention. A five-year-old tower server running Windows Server 2025 may lack a TPM 2.0 chip or support for key attestation. August’s readiness messages will reveal the gap, but the fix—buying new hardware—takes time and money that should appear in next year’s budget.

How We Got Here: KMS and the Move to Hardware Security

KMS has been part of Windows volume activation since the Windows Vista/Server 2008 era. Over the years, attackers have exploited weaknesses in software-only activation models—for example, by emulating a KMS server or extracting activation keys from a compromised host. Microsoft has periodically hardened the service, but the root vulnerability remained: a KMS host’s authority ultimately rested on a software credential that could be duplicated.

TPM-based attestation closes that loophole by bringing hardware-rooted trust into the activation chain. This isn’t the first time Microsoft has leaned on TPMs for platform security; Windows 11’s strict hardware requirements made TPM 2.0 mandatory for client devices. Extending that philosophy to server activation makes sense in a landscape where supply-chain and credential-theft attacks are increasingly common.

The KMS Hardware-Secured announcement builds on work already visible in Windows Server 2025. The operating system itself includes the plumbing for TPM-backed activation, and the August 2026 update simply surfaces the readiness telemetry. By the time the next LTSC ships, the shift will be code-complete—the only variable is whether your hardware is ready.

Your Action Plan: A Readiness Checklist

Don’t wait until the next LTSC release date is announced. Use August 2026 as a forcing function to bring your KMS infrastructure up to speed.

Step 1: Run the Readiness Check

On each suspected KMS host, open an elevated command prompt and run:

slmgr /dlv

Look for the hardware-based security eligibility line. Document the result in your inventory spreadsheet.

Step 2: Confirm TPM Key Attestation Support

Even if the slmgr output is positive, verify the TPM’s capability directly. Open an elevated PowerShell session and execute:

Get-TpmSupportedFeature -FeatureList "Key Attestation"

A response that lists Key Attestation confirms the TPM supports the feature Microsoft expects. If the command returns an empty list or an error, the server cannot perform hardware-based attestation—regardless of any other TPM status.

Step 3: Check Hardware Certification

Search the Windows Server Catalog for each server model. Uncertified hardware may still pass slmgr checks today, but it’s a gamble. A future cumulative update or the LTSC installation itself could enforce certification at the driver or firmware level.

Step 4: Plan for Virtualized KMS Hosts

Microsoft’s silence on virtualized hosts is the biggest open question. Many organizations run KMS inside Hyper-V or VMware VMs to simplify management. While a virtual TPM (vTPM) exists in many hypervisors, Microsoft hasn’t confirmed whether vTPM-based attestation will satisfy the hardware-secured requirements. Until guidance emerges, keep at least one physical KMS host healthy and compliant as a fallback.

Step 5: Budget and Schedule Replacements

Any server that fails the readiness check will need to be removed from the KMS role before the next LTSC adoption. Work with procurement now to secure quotes for replacements that carry a Windows Server 2025 (or later) certification and a TPM 2.0 chip with key attestation support. If your refresh cycle aligns with the LTSC release, fold the KMS host upgrade into that project.

Looking Ahead

The August 2026 readiness checks are a polite warning. The real deadline arrives with the next LTSC release, when Microsoft flips the switch from optional to required. Between now and then, expect Microsoft to publish more granular documentation, especially around virtualized scenarios and any grace periods for mixed environments.

For most organizations, the technical work is straightforward: check a few boxes, run a couple commands, and replace a handful of aging servers. The risk lies in procrastination. Activation infrastructure is easy to forget until it breaks, and a broken KMS host can halt deployments across an entire network. The readiness checks give you two years to act—use them.