Microsoft Tightens Corporate Windows Activation with TPM-Bound KMS Servers
Microsoft has decided to tighten controls in its corporate Windows activation system, prompting some media outlets to declare the end of pirated Windows 11. In reality, the hunt for home users has not begun: the new requirement will only affect organizations that maintain their own KMS servers.
KMS allows companies to activate computers inside their network through a single server without sending each machine directly to Microsoft. The problem is that attackers have learned to create fake and cloned KMS hosts that distribute licenses to devices for which no one has paid.
The new KMS Hardware-Secured technology will bind such a server to TPM. The chip must confirm the hardware identity to Microsoft and prove that the platform has not been modified after registration. If the check fails, activation of the corporate fleet will be blocked.
In August 2026, Windows Server 2025 will begin displaying warnings about readiness for the new requirements. They will become mandatory with the release of the next LTSC version of Windows Server, whose date has not yet been announced. Until then, existing KMS systems will continue to work as usual.
Administrators of physical servers can already check support for TPM attestation using the command Get-TpmSupportedFeature -FeatureList "Key Attestation". For virtual KMS hosts, Microsoft is still preparing separate recommendations.
The innovation is not directly related to pirated copies of Windows on home PCs. It does not check the user computer and does not affect popular illegal activation methods that do not rely on corporate KMS servers. Even the KMS38 method closed in November 2025 was a different story: it faked the activation period through a system file and had nothing to do with TPM or real KMS infrastructure.
Thus, Microsoft is indeed strengthening license protection, but so far only where Windows is activated in bulk. Home pirates can breathe easy, while corporate administrators should check their TPM support.
Related articles
Russian State Duma Approves Outsourcing of Banking Secrecy and Client Data Without Consent
The State Duma has passed legislation in its second and third readings permitting Russian banks to transfer client data processing, including banking secrecy and personal information, to external IT contractors and cloud providers. No separate client consent will be required for such transfers. Only accredited Russian IT companies and banks holding a universal license that meet strict domestic control criteria may act as processors, with all servers required to remain inside Russia. Banks must notify the Central Bank of Russia in advance, and contractors must undergo audits by organizations licensed by FSTEC or FSB Russia. Special approval procedures involving the Central Bank, FSB, and Rosfinmonitoring apply to banks under foreign control. The law preserves banking secrecy while expanding the circle of authorized handlers under defined security obligations.
Russia's MinTsifry Drafts Security Requirements for Trusted Domestic Software
The Russian Ministry of Digital Development has published a draft set of requirements for trusted Russian software that go beyond simple domestic origin. The proposals focus on resilience against external interference, absence of known unpatched vulnerabilities, and full development and build processes conducted inside Russia under controlled conditions. Additional rules cover up-to-date component inventories, in-country technical support, and timely disclosure of software updates. Special compatibility mandates are included for Russian browsers and electronic signature tools across multiple product classes such as operating systems, databases, office suites, and communication applications. Compliance verification would be voluntary through expert review, with results recorded in the official Russian software registry and internal-use software lists.
Rostelecom Calls for 'Doomsday' Data Centers to Counter Drone Attacks and Infrastructure Risks
Rostelecom executive Valery Ermakov has urged Russian companies to build geographically distributed backup data centers, dubbed 'doomsday' facilities, to ensure service recovery after site losses. The recommendation follows drone strikes that disabled three Yandex data centers in Sasovo, Kaluga, and Vladimir, disrupting both internal services and Yandex Cloud clients. Ermakov explained that previous centralized infrastructure, built for economic efficiency, is no longer viable under changed threat models that now include physical attacks previously considered unthinkable. He advocated a micro-cellular architecture with services spread across many sites connected by high-speed links, while warning that Russian backbone networks are overloaded and much fiber optic infrastructure dates back 20-30 years. Rostelecom positioned its TEA NEXT line running from Kaliningrad to Mongolia as a source of additional capacity to address potential backbone shortages. Yandex responded to the incidents by accelerating client data migration to partner cloud providers.
Russian Firms Accelerate Cybersecurity Strategy Adoption as Risk Reduction Emerges as Top Priority
A recent AM Live broadcast survey reveals that Russian small, medium, and large companies are increasingly developing information security strategies, with the share of organizations actively working on them rising from 9% to 28% year-over-year. The primary goal cited for 2027 is risk reduction and financial loss mitigation, selected by 78% of respondents compared to 55% previously. Key barriers have shifted, with insufficient source data now affecting 64% of companies and lack of top-management buy-in rising to 43%. Experts including Yaroslav Napalkov from MTS Bank and Nikolay Kazantsev from Securitm emphasized the need for risk-oriented approaches, three-year planning horizons with annual reviews, and early engagement with CEOs and stakeholders. Only 16% of firms have fully operationalized their strategies with metrics and cyber exercises, while personnel shortages remain the leading constraint at 59%.