KMS and TPM in 2026: What’s Changing and How to Prepare

The short version

Microsoft announced KMS Hardware-Secured in July 2026, a TPM attestation mechanism for corporate KMS servers. Starting August 2026, Windows Server 2025 shows readiness notifications. The requirement becomes mandatory only with the next LTSC release of Windows Server, likely in 2028. Existing KMS deployments keep working as before.

Check your KMS host status right now:

[bash] slmgr /dlv
[/bash]

What KMS Hardware-Secured is and why Microsoft built it

KMS (Key Management Service) is the corporate Windows activation scheme. A company runs an internal KMS server, and every machine on the network activates through it. Activation lasts 180 days and renews automatically as long as the machine can reach the server.

The problem Microsoft wants to close is fake KMS servers. They’ve been used to illegally activate Windows on both corporate and home machines. To verify authenticity, Microsoft decided to use the TPM chip, a hardware root-of-trust module that’s been on most motherboards since 2016.

Who this affects right now

Let’s break it down by category:

Corporate KMS on licensed Windows Server

If you’re running licensed Windows Server 2019/2022/2025 with a real KMS key (GVLK + Volume License), nothing changes until Windows Server 2028 ships. You just need to make sure TPM 2.0 is enabled in UEFI on the server.

Check for TPM:

[bash] Get-TPM
[/bash]

Or open tpm.msc directly on the server.

KMS server running on a virtual machine

This is trickier. Virtual machines don’t have a physical TPM by default. Microsoft’s answer is vTPM, a virtual TPM. It’s supported in:

• Hyper-V Generation 2 VM
• VMware vSphere 6.7+ with vTPM enabled
• Proxmox VE 7+ with TPM emulation via swtpm

Enable vTPM in Proxmox for an existing VM:

[bash] qm set VMID –tpmstate0 file=local:1,version=v2.0
[/bash]

Unofficial KMS activator

If you’re using KMSAuto, KMSpico, or a homemade KMS server built on an emulator, warnings will start appearing in Windows Server 2025 from August 2026 onward. For now these are informational messages. Actual blocking arrives with Windows Server 2028.

That gives you at least a year and a half to two years to prepare.

How to check if your infrastructure is ready

Microsoft added a check to the slmgr command. On a KMS host running Windows Server 2025:

[bash] slmgr /dlv
[/bash]

The output will include lines like:

[bash] KMS Hardware-Secured: Ready
[/bash]

Or, if the server isn’t ready:

[bash] KMS Hardware-Secured: Not supported – TPM 2.0 not available
[/bash]

Checking TPM version in PowerShell:

[bash] Get-WmiObject -Namespace “root\cimv2\security\microsofttpm” -Class Win32_Tpm | Select-Object -Property SpecVersion
[/bash]

You need version 2.0. Version 1.2 won’t work.

Timeline and action plan

What to do if TPM is missing or unsupported

Option 1: Enable TPM in UEFI

Most server hardware since 2016 already has TPM, just disabled in UEFI. Go into BIOS/UEFI, find Security or Advanced → TPM Configuration, and enable TPM 2.0.

On Dell servers: iDRAC → System BIOS → Security → TPM Security.
On HP servers: RBSU → Security → Trusted Platform Module.
On Supermicro: Advanced → Trusted Computing.

Option 2: vTPM on a virtual machine

If your KMS server runs on a VM, enable a virtual TPM. It’s simpler than it sounds.

Hyper-V (PowerShell):

[bash] Set-VMSecurity -VMName “KMS-Server” -VirtualizationBasedSecurityOptOut $false
Enable-VMTPM -VMName “KMS-Server”
[/bash]

VMware via vCenter: VM → Edit Settings → VM Options → Security → Enable virtualization based security.

Option 3: Switch to MAK activation

MAK (Multiple Activation Key) is an alternative to KMS for smaller infrastructures. Each key activates a fixed number of machines directly through Microsoft’s servers. No KMS server needed at all.

This makes sense if you have fewer than 25-50 machines and running a KMS infrastructure isn’t worth the hassle.

Option 4: Azure AD / Microsoft 365 activation

For organizations with Microsoft 365 Business or Enterprise, activation goes through Azure AD without a local KMS server. The machine activates when a corporate account signs in.

What actually changes for most sysadmins

Honestly, for most of you, nothing critical happens before 2028. Existing KMS servers keep working. Microsoft gave at least two years to prepare.

The internet panic about “KMS dying right now” is overblown. The August notifications are diagnostics, not blocking. Think of it as a service reminder sticker on your windshield: it warns you ahead of time, it doesn’t stop the car on the spot.

The real task right now is to run an inventory and find out whether your KMS servers have TPM. If they do, and version 2.0 at that, you can relax. If not, plan what to do before 2028.

Troubleshooting

slmgr /dlv doesn’t show KMS Hardware-Secured lines

The update that adds these lines came with August 2026 patches. If those patches aren’t installed, you won’t see them. Update Windows Server 2025 to the current state:

[bash] sconfig
[/bash]

Option 6: Download and Install Updates.

TPM shows version 1.2 instead of 2.0

Older hardware (pre-2016) often has TPM 1.2. You can’t upgrade it, it’s a hardware chip. Your options: buy a TPM 2.0 module if the motherboard has a TPM/TCM header, move KMS to newer hardware, or switch to MAK activation.

Can’t add TPM to a Proxmox VM, getting an error

swtpm needs to be installed on the Proxmox host:

[bash] apt install swtpm swtpm-tools
[/bash]

Once that’s installed, adding vTPM to the VM will work.

FAQ

Will KMS activation stop working in August 2026?

No. In August 2026, Windows Server 2025 will only show informational notifications. Existing KMS servers keep working unchanged. TPM becomes mandatory only with the next LTSC release of Windows Server, likely in 2028.

Do I need to do anything right now?

Check TPM status on your KMS server with slmgr /dlv and Get-TPM. If you have TPM 2.0, there’s nothing to do. If not, plan a fix before 2028.

Does this affect home users running pirated Windows?

KMS Hardware-Secured targets fake corporate KMS servers. Activation methods like HWID and digital license aren’t affected by this measure. Corporate activators based on emulated KMS servers are at risk after 2028.

What if I have an old server without TPM 2.0?

Nothing changes before 2028. After that, you have three options: add a TPM 2.0 module if the motherboard supports the header, move the KMS role to newer hardware, or switch to MAK or Azure AD activation.

Does vTPM in Hyper-V work as a replacement for physical TPM?

Yes. Microsoft explicitly confirmed that vTPM in Hyper-V Generation 2 will count as sufficient for KMS Hardware-Secured. VMware vSphere vTPM and Proxmox swtpm should also qualify. There’s no official confirmation yet, but technically they implement the same TPM 2.0 standard.

What to expect

KMS Hardware-Secured is a gradual tightening, not an instant shutoff. Microsoft gave sysadmins at least two years to prepare. Most modern hardware already has TPM 2.0, you just need to make sure it’s turned on.

If your KMS infrastructure is licensed and running on decent hardware, this whole thing will pass you by. If it’s not, you’ve got time to sort it out. Drop a comment if you have questions about your specific setup, happy to help work through it.