KMS key management service is a batch activation technology provided by Microsoft mainly for enterprises and large organizations. This activation technology can simplify the complexity of enterprise activation systems. At the same time, virtual machines equipped with Windows Server in the field of cloud computing can also be activated on demand. For example, KMS is used to activate a server instance when it is opened, and the activation authorization is automatically revoked when deleted.
It is very simple for ordinary users to set up a KMS activation server. There are relevant open source warehouses on the Internet. Users can set up an activation server on any host or server. For example, some router firmware even comes with a KMS plug-in that can be used to quickly set up an activation server in the LAN to achieve rapid activation of devices in the LAN.
Now Microsoft has begun to strengthen the KMS activation verification mechanism:
Microsoft recently announced that it has strengthened the KMS activation verification mechanism. Microsoft hopes to strengthen the security of batch activation through a new hardware support trust model. This enhanced feature, called KMS Hardware Security, will apply to the authentication mechanism based on the Trusted Platform Module TPM. Before the KMS server activates the downstream system, Microsoft will pre-verify whether the activation server is running on trusted hardware.
Microsoft says the new KMS hardware security features are designed to address security and compliance risks posed by fake or cloned KMS servers, which have been used by "attackers" to bypass controls. By adding validation of the Trusted Platform Module, Microsoft can ensure that only validated KMS activation servers running on uncompromised hardware can issue licenses to downstream systems.
The new verification process looks roughly like this:
In the new activation mode, the KMS server will first use the authentication supported by the Trusted Platform Module to establish its hardware identity. Then the Microsoft server will conduct independent security verification of this hardware identity. After passing the verification, the KMS activation server can issue activation licenses to downstream systems. The Trusted Platform Module also confirms the integrity of the platform, which cannot be verified if the activation server has been tampered with.
Microsoft is currently encouraging enterprises and institutions that use KMS activation servers to start evaluating production environments before transition. For virtualized KMS activation servers, Microsoft will release relevant technical guides in the future to help IT administrators complete the necessary preparation and migration work (virtualized servers may not have Trusted Platform Module certification).
Testing TPM verification starting in August:
According to the plan, Microsoft will take the lead in bringing the Trusted Platform Module verification function on Windows Server 2025 starting in August 2026. At that time, IT administrators can deploy the KMS service on the system and then verify whether the server meets the new hardware requirements.
After deploying the service, IT administrators can view the information through the command slmgr -dlv. Eligible devices will be displayed: This device is eligible to be used as a KMS host for hardware-based security functions. Ineligible devices appear as: This device does not meet the requirements for using a KMS host with hardware-based security.
Microsoft also revealed that the subsequent release of Windows Server LTSC will mandate that KMS servers must meet Trusted Platform Module verification. The next long-term service version should be Windows Server 2028, so enterprises must prepare for the transition in advance to avoid batch activation problems in the future.
Impact on ordinary users:
This improvement by Microsoft will not have any impact on ordinary users in the short term, because it takes time for Microsoft to promote hardware verification, so it will not have any impact on users who build their own KMS servers for the time being. Some activation tools also have built-in KMS functions to build KMS servers in the local environment to achieve local activation. This has no impact for the time being.
Looking to the future, the practice of setting up KMS servers arbitrarily may be restricted. Users may not be able to set up KMS servers at will. However, other community users may find ways to bypass Microsoft's restrictions and continue to provide ways to build KMS servers that do not require TPM modules and can pass Microsoft authentication.