Windows activation Archives

Winsage

July 26, 2026

Microsoft is using TPM chips to crack down on pirated Windows activations

Microsoft has mandated the inclusion of the Trusted Platform Module (TPM) as a standard feature in all new motherboards and CPUs to enhance the Windows activation process. The company has introduced an enhancement to its Key Management Service (KMS) that leverages TPM's security capabilities to authenticate the legitimacy of KMS servers. This new "TPM-based attestation" aims to mitigate exploitation risks associated with KMS by validating the cryptographic integrity of KMS servers. Starting in August 2026, TPM-based attestation will be required for KMS activation with the next release of Windows Server. Microsoft has also closed off the "KMS38" activation method in 2025, while traditional KMS activation remains functional. The Massgrave collective has developed an Online KMS method that may be impacted by the new TPM-based attestation.

Winsage

July 23, 2026

Microsoft making a new feature mandatory requirement for Windows KMS activation

Microsoft has introduced enhancements to its Windows operating system security, including an update to Entra ID authentication with default passkeys and AI-enhanced security updates. A key advancement is the KMS Hardware-Secured initiative, which uses Trusted Platform Module (TPM)-based attestation to ensure KMS hosts operate on trusted hardware for Windows volume activation. This aims to combat risks from counterfeit KMS servers. Under the new model, KMS hosts will confirm their hardware identity using TPM before activating Windows devices. Starting in August 2026, Windows Server 2025 will provide readiness messaging for KMS host compliance with new security requirements. TPM attestation will be mandatory for KMS Hardware-Secured activation with the upcoming Windows Server 2028 LTSC release. Organizations are advised to prepare for this transition.

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

April 13, 2026

“More secure, reliable, user-friendly”: Microsoft explains why it quietly killed Windows 11’s phone activation option

Microsoft has discontinued the last method for activating Windows 10 or Windows 11 without an Internet connection, specifically the telephone activation option. Users have reported confusion and frustration as the option remained visible in Windows, but attempts to use it led to redirection to online portals. Microsoft has not fully disclosed the reasons for this change, but it aligns with a shift towards digital solutions and emphasizes the importance of Internet connectivity in software management.

Winsage

April 1, 2026

Local vs. Microsoft account in Windows 11: How to decide and set up your preference

Setting up a Windows 11 PC requires creating a user account, with the Windows Setup program encouraging the use of a Microsoft account. A local account can still be established, though it is less promoted. Local accounts store credentials on the device, while Microsoft accounts use an email and password managed on Microsoft's servers. Local accounts are straightforward but can lead to frustration if passwords are forgotten. Microsoft accounts offer benefits like automatic encryption, easy restoration of activation, and synchronization of settings across devices. Privacy concerns regarding Microsoft accounts are often overstated, as data collection is tied to machine ID rather than account type. In Windows 11 Home edition, a temporary Microsoft account can be created during setup to later switch to a local account. In Windows 11 Pro edition, selecting the work option allows bypassing the Microsoft account requirement, with options to create a local account through domain joining. Third-party tools can assist in setting up a local account.

Winsage

January 30, 2026

Windows 11 KB5074105 update fixes boot, sign-in, and activation issues

Microsoft has released the KB5074105 preview cumulative update for Windows 11, which includes 32 enhancements to improve user experience. This optional update allows administrators to test upcoming fixes and features before the next Patch Tuesday. It addresses issues such as Explorer.exe hanging during login with specific startup apps, system unresponsiveness during startup with Windows Boot Manager debugging enabled, iSCSI boot failures, and problems with Windows license migrations during upgrades. The update elevates Windows 11 25H2 and 24H2 devices to builds 26200.7705 and 26100.7705, respectively. Key highlights include enhanced Cross-Device Resume functionality, support for peripheral fingerprint sensors in Windows Hello Enhanced Sign-in Security, fixes for unresponsiveness when running Windows Terminal with elevated permissions, resolution of GPU-related system errors, and improvements to Windows Sandbox. Microsoft will also introduce distinct identifiers for Windows 11 and Windows Server 2025 updates starting with the January 2026 security update, and has simplified update titles for better accessibility.

Winsage

January 4, 2026

20+ Years of Windows Activation Method Invalidated Overnight: Win11/Win10 Phone Activation Suddenly Fails Without Microsoft Announcement or Notice

Reports indicate that the phone activation feature for Windows 11, Windows 10, and Windows 7 is no longer operational, affecting users in government agencies, enterprise organizations, and industrial control systems. This change was made without any official announcement from Microsoft, and practical tests show that nearly all offline activation methods have become ineffective. Users attempting to activate via phone are met with an automated message directing them to online activation, despite support documentation still suggesting phone activation is possible. This shift poses significant challenges for environments that require offline activation, leading to user backlash against Microsoft for the abrupt disruption of established activation processes.