You heard wrong, Microsoft isn’t ending pirated Windows 11 with TPM, and the new rule only affects enterprise KMS servers

Microsoft published a document on July 22 announcing KMS Hardware-Secured, a new requirement that binds Windows volume activation servers to a TPM chip. A few of our readers have messaged us asking if this is the company finally taking a hard line against pirated Windows 11.

The confusion comes from a few tech publications, which reported the TPM attestation part correctly, but then tied it to Microsoft killing off a piracy method called KMS38 back in November 2025, and predicted that this would be the end of pirated Windows activations for good.

The good news is that Redmond isn’t hunting down pirated Windows copies of regular users. However, the change does affect organizations running their own KMS servers.

Windows Server 2025 will show readiness alerts for this in August 2026. TPM attestation becomes mandatory once Microsoft ships the next Windows Server LTSC release, and there isn’t a release date for that yet.

Disclaimer: To be clear, we don’t endorse piracy. The goal here is to cut through misinformation.

Why is Microsoft doing this?

Microsoft’s document says attackers have used fake or cloned KMS servers to activate Windows machines they aren’t licensed for, inside organizations that run real KMS infrastructure.

A rogue server, convincing enough to be on a company’s network and answer activation requests the way a real KMS host would, can quietly license machines the company didn’t pay for.

The newly announced KMS Hardware-Secured makes a KMS host prove two things using its TPM before Microsoft lets it serve any activations.

• First, the TPM establishes the host’s hardware identity, and Microsoft checks that identity against what it expects.
• Second, the TPM confirms the platform hasn’t been tampered with since that identity was established.

A host that fails either check doesn’t get to hand out licenses.

How organizations should prepare, according to Microsoft

For a physical KMS host, Microsoft says to confirm it’s certified on the Windows Server Catalog and that its TPM is installed and enabled. For a virtual KMS host, Microsoft says guidance is still coming in a future post, meaning even Microsoft hasn’t published the rules for that scenario yet.

But there’s nothing to panic here. Admins can check TPM readiness now by running this command in an elevated PowerShell session:

Get-TpmSupportedFeature -FeatureList “Key Attestation”

A machine that supports the feature responds with “key attestation,” confirming the capability exists before Microsoft begins enforcing KMS Hardware-Secured.

From August 2026, Windows Server 2025 will show this readiness status. Running slmgr /dlv on a KMS host either returns “This device is eligible to serve as a KMS host with hardware-based security,” or “This device does not meet the requirements for using KMS host with hardware-based security.”

Event Viewer logs the identical status under Applications and Services Logs > Key Management Service. Nothing here blocks activation yet. Existing KMS deployments keep working exactly as they do today until Microsoft ships the LTSC release that makes the requirement mandatory.

Microsoft isn’t cracking down on pirated Windows for regular users

Some publications framed KMS Hardware-Secured as Microsoft going after pirated Windows activations, with headlines suggesting TPM chips are now the tool Microsoft uses to stop pirated copies from working.

Our readers who saw those headlines had every reason to worry their pirated Windows 11 install was about to stop activating.

That’s not what’s happening. KMS Hardware-Secured doesn’t check anything on the PC you’re using right now. It checks the server organizations use to activate Windows across their fleet, and it does that by requiring the server itself to carry a TPM chip that can prove its own identity to Microsoft.

The publications also brought up KMS38, an offline piracy method Microsoft shut down in November 2025, and used it to suggest that since Microsoft killed one piracy trick before, it might be repeating that here.

KMS38 had nothing to do with TPM chips or KMS servers at all, though. It exploited a Windows upgrade helper file to fake a long activation date, and Microsoft’s fix changed how that file validates its data, an unrelated fix for an unrelated method.

The piracy method that does use KMS, called Online KMS, doesn’t reach a real host either. It stands up a fake server, on your own PC or a public one a piracy toolkit runs, that answers activation requests the way a real KMS host would.

Your Windows installation asks if it’s allowed to activate, and the fake server just says yes. So there’s no TPM check for it to fail.

Most pirated Windows installs today don’t use KMS at all

HWID activation, the default most piracy toolkits recommend, registers a PC’s hardware ID with Microsoft’s activation servers as a legitimate digital license, permanently, with no KMS host involved.

TSforge writes forged licensing data directly into the two files inside Windows’ Software Protection Platform that manage every legitimate activation. Neither method needs KMS.

In short, the new KMS Hardware-Secured methods do not affect any of the existing piracy methods to activate Windows. But the important question to ask here is why Windows is pirated in the first place!

Why Windows piracy is still so widespread

Locking a KMS host down with TPM attestation shows Microsoft can build serious anti-spoofing defences if they wanted to. But the truth is that Microsoft doesn’t care about pirated individual Windows PCs

A Windows 11 Home license costs $139 from Microsoft, and Pro costs $199. Laptop makers get volume discounts on top of an OEM license, but that price still gets folded into what you pay for the machine.

For anyone building a budget PC or buying a cheap laptop, paying $139 just for the operating system on top of the hardware is a hard sell, and is why Massgrave and tools like it stay in wide use years after Microsoft first started trying to lock Windows down.

I bought a laptop for work instead of building a desktop partly because of this.

Massgrave’s FAQ says Microsoft has not taken home users to court over a handful of pirated activations, since legal action against individuals would cost more than Microsoft would recover.

The company’s revenue push runs through subscriptions and services, such as OneDrive, Microsoft 365, Copilot, and ads in MSN feed, regardless of whether the Windows license was paid for or not.

Windows 11 has felt loaded with upsells over the past couple of years for this reason. Microsoft eventually admitted it had gone too far and promised a “calmer and more chill OS with fewer upsells,” and it has started delivering on that, turning off the MSN feed and ads in Widgets by default.

The incentive behind all of it hasn’t moved, though. Whether you paid for your Windows license appears to concern Microsoft a lot less than whether you keep using Windows at all.

The post You heard wrong, Microsoft isn’t ending pirated Windows 11 with TPM, and the new rule only affects enterprise KMS servers appeared first on Windows Latest