Trusted Platform Module Archives

Winsage

August 4, 2026

Microsoft Expands Windows Hello ESS to External Fingerprint Readers

Microsoft is integrating Windows Hello Enhanced Sign-in Security (ESS) with compatible external fingerprint readers, allowing passwordless sign-ins on a wider range of Windows 11 devices. This update enhances biometric authentication security by utilizing hardware-backed protections such as the Trusted Platform Module (TPM) and Virtualization-Based Security (VBS), which isolate sensitive biometric data from malware and unauthorized access. Previously, only devices with integrated fingerprint sensors could fully utilize ESS, but the recent update (KB5101684) enables external fingerprint readers to function within the ESS framework. The update is being rolled out for Windows 11 versions 25H2 and 24H2, and users can set up fingerprint authentication by connecting a compatible reader. This advancement aids IT administrators in implementing passwordless authentication while maintaining security protocols.

Winsage

August 1, 2026

Not sure whether to use Windows Hello or Enhanced Sign‑in Security? This breakdown makes the choice easy

Microsoft will introduce Enhanced Sign-in Security (ESS) in the August 2026 update for Windows 11, allowing support for compatible external fingerprint readers. ESS aims to enhance the security of the authentication process rather than improve the accuracy of biometric recognition. Unlike standard Windows Hello, which processes biometric authentication through the operating system, ESS utilizes Virtualization-Based Security (VBS) and Trusted Platform Module (TPM) 2.0 to isolate sensitive operations in a protected environment. ESS-compatible fingerprint readers have dedicated secure processors, store templates internally, and communicate with the operating system via encrypted channels. Users can enable ESS by navigating to Settings > Accounts > Sign-in options on their devices. If a device does not support ESS, standard Windows Hello remains a robust authentication option.

Winsage

August 1, 2026

Windows Hello vs. Enhanced Sign‑in Security: Which sign‑in method actually keeps your Windows 11 PC safer, and what’s the difference?

Microsoft will introduce Enhanced Sign-in Security (ESS) in the August 2026 update for Windows 11, which will support compatible external fingerprint readers. ESS aims to strengthen the authentication process against potential attacks by shifting processing to isolated, hardware-protected environments using Virtualization-Based Security (VBS) and TPM 2.0 technology. Unlike standard Windows Hello, which processes biometric authentication through the operating system, ESS-compatible devices perform more processing within the hardware itself, ensuring that only authentication results are sent to the OS. To enable ESS, users must navigate to Settings > Accounts > Sign-in options and follow prompts to set up their fingerprint recognition. Existing non-ESS biometric enrollments will be removed during the upgrade to ensure security.

Winsage

July 29, 2026

Microsoft will make it harder to illegally activate Windows and close a popular piracy loophole

Microsoft is requiring the use of TPM 2.0 security modules for Key Management Service (KMS) activation servers to combat unlicensed software and corporate piracy. KMS, used by organizations for mass activation of devices, has been targeted by hackers who create counterfeit servers. The new protocol mandates that KMS hosts validate their hardware credentials through the TPM 2.0 chip before activating client devices. This initiative will mainly affect illegal infrastructures in the corporate sector, while legitimate PC users will not be impacted. Starting in August 2026, Windows Server 2025 will introduce hardware readiness alerts to help system administrators prepare for these changes. TPM 2.0 has been required for Windows 11 since 2021, and its application is being expanded to address vulnerabilities in volume licensing.

Winsage

July 29, 2026

Windows BitLocker is fine. I still don’t trust it with everything

BitLocker is an encryption tool in Windows that secures data using a system of keys, with some keys stored in the motherboard's Trusted Platform Module (TPM) and others on the storage drive. Users must save a recovery key to prevent data loss, which can be stored on a removable disk, printed, or uploaded to the cloud. For Home license users, the recovery key usually defaults to cloud storage. Recently, vulnerabilities in BitLocker, including the "YellowKey" flaw, have been discovered, allowing individuals with physical access to bypass encryption. A second vulnerability was identified in June, also exploiting physical access to circumvent BitLocker's security.

Winsage

July 29, 2026

Microsoft reportedly using TPM chips to weed out Windows piracy

Microsoft's Trusted Platform Module (TPM) 2.0 has been integral to Windows 11's security since its launch in 2021. TPM is now standard in most CPUs, allowing Microsoft to enhance device activation security. The current Key Management Service (KMS) model has vulnerabilities that hackers exploit, prompting the need for stronger device identity and activation integrity assurances. TPM provides a hardware-level security mechanism for the activation process, where KMS hosts must present TPM credentials to validate their hardware identity and confirm they are uncompromised. Starting with upcoming Windows Server releases, KMS hosts will be required to prove they run on verified hardware before activating clients. By August 2026, Windows Server 2025 will help administrators prepare for these changes.

Winsage

July 27, 2026

Microsoft moves to end pirated Windows activations

Microsoft is introducing the KMS Hardware Secured system to enhance Windows licensing security by making unauthorized activation methods more difficult. This system will use TPM-based attestation to authenticate the server managing activation requests, ensuring only legitimate devices are recognized. Readiness notifications for Windows Server 2025 will begin in August 2026, allowing administrators to prepare for the transition to TPM-based attestation, which is expected to become a requirement for KMS activation in a future Windows Server release. This initiative targets corporate clients using Windows volume licensing to complicate unauthorized activation. Additionally, Microsoft plans to reduce its workforce by approximately 4,800 positions, or nearly 2.1% of its global staff, as part of a corporate transformation strategy.

Winsage

July 26, 2026

Microsoft is using TPM chips to crack down on pirated Windows activations

Microsoft has mandated the inclusion of the Trusted Platform Module (TPM) as a standard feature in all new motherboards and CPUs to enhance the Windows activation process. The company has introduced an enhancement to its Key Management Service (KMS) that leverages TPM's security capabilities to authenticate the legitimacy of KMS servers. This new "TPM-based attestation" aims to mitigate exploitation risks associated with KMS by validating the cryptographic integrity of KMS servers. Starting in August 2026, TPM-based attestation will be required for KMS activation with the next release of Windows Server. Microsoft has also closed off the "KMS38" activation method in 2025, while traditional KMS activation remains functional. The Massgrave collective has developed an Online KMS method that may be impacted by the new TPM-based attestation.

Winsage

July 23, 2026

Microsoft making a new feature mandatory requirement for Windows KMS activation

Microsoft has introduced enhancements to its Windows operating system security, including an update to Entra ID authentication with default passkeys and AI-enhanced security updates. A key advancement is the KMS Hardware-Secured initiative, which uses Trusted Platform Module (TPM)-based attestation to ensure KMS hosts operate on trusted hardware for Windows volume activation. This aims to combat risks from counterfeit KMS servers. Under the new model, KMS hosts will confirm their hardware identity using TPM before activating Windows devices. Starting in August 2026, Windows Server 2025 will provide readiness messaging for KMS host compliance with new security requirements. TPM attestation will be mandatory for KMS Hardware-Secured activation with the upcoming Windows Server 2028 LTSC release. Organizations are advised to prepare for this transition.

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.