Microsoft Blocks KMS38 Activation on Windows 11 — Here’s What You Need to Know

Microsoft has made another major move in its long-running battle against unauthorized Windows activations. With the November Patch Tuesday update, the company quietly disabled KMS38—the famous offline activation workaround widely used by tech enthusiasts and pirates alike. But while some have celebrated this as a decisive win for Microsoft, the reality is a lot more complicated. Offline activation is dead… but Windows piracy is very much alive.

Here’s the full story of what changed, why it matters, and how this update actually gives Microsoft more power than ever over user data—even among pirates.

Microsoft Shuts Down KMS38 With November’s KB5068861 Update

Several outlets have confirmed that Microsoft has now blocked KMS38, the offline activation method distributed through Massgrave’s popular tools.
The KB5068861 cumulative update for Windows 11 (versions 24H2 and 25H2), based on build 26100.7019, deprecated one critical component:

gatherosstate.exe, previously used by enterprises to migrate KMS activations during upgrades.

This tool was also the backbone of KMS38. By altering activation timestamps, it allowed users to extend Windows activation up to January 19, 2038—a date that’s not random at all.

Why 2038? The Infamous Unix Timestamp Bug

The timestamp used by KMS38 pointed to 19 January 2038 at 03:14:07 UTC, which is the maximum value a 32-bit Unix timestamp can store.
This is connected to the well-known Y2K38 bug, where 32-bit systems essentially “run out of time.”

KMS38 didn’t crack Windows in the traditional sense; it simply postponed the activation deadline to the edge of the Unix clock. Once set, Windows wouldn’t ask for activation again until that date.

But with the latest updates, Microsoft has slammed the door shut.

Is This a Major Win Against Piracy? Not Really.

Anyone expecting this to cripple Windows piracy is going to be disappointed.
KMS38 may be gone, but two activation methods still work flawlessly:

• HWID (Hardware ID Activation)
• TSforge

In fact, on November 11, Massgrave released MAS 3.8, humorously named “R.I.P. KMS38”, confirming that the other methods remain intact.

So if Microsoft hoped to stop piracy altogether… that didn’t happen.

Why It Matters: HWID and TSforge Require Internet Access

Here’s the real difference:
KMS38 worked completely offline, which meant:

• No Microsoft contact
• No telemetry
• No hardware fingerprinting
• No digital license stored on Microsoft servers

You could activate Windows in airplane mode, unplugged from any network, and Microsoft would never even know the device existed.

That era is over.

Today, the remaining piracy methods—HWID and TSforge—require an online connection.
Both create a digital license stored on Microsoft’s servers, tied permanently to your device’s hardware configuration.

This means:

• Your Hardware ID (HWID) is uploaded to Microsoft
• A digital license is generated and stored online
• Any future reinstall requires reconnecting to Microsoft’s servers
• Telemetry and hardware details are inevitably shared

Even pirates now need Microsoft’s approval.

Using HWID = Handing Your System Information to Microsoft

HWID activation works by generating a permanent digital license based on your PC’s hardware.
Once created, that license lives in Microsoft’s activation database—forever.

Reinstall Windows?
You must reconnect and authenticate again.

New motherboard?
The license may break, forcing another online activation.

In short, Microsoft knows exactly which hardware belongs to that pirated license.

TSforge works the same way: an online handshake with Microsoft is mandatory.

The Ironic Outcome: To Pirate Windows, You Must Identify Yourself

With KMS38 gone, piracy isn’t eliminated—just transformed.

Anyone using HWID or TSforge still avoids paying the €145 official Windows license price, but they’re giving Microsoft something arguably more valuable:

• Their hardware profile
• Their activation footprint
• Their device’s long-term identity inside Microsoft’s systems

For a company that thrives on data, this is a strategic win.
Microsoft disabled an offline loophole that protected user anonymity—not necessarily to stop piracy, but to ensure that every activation, even illegal ones, flow through its servers.

Conclusion

By killing KMS38, Microsoft didn’t defeat Windows piracy—it reshaped it. The only remaining activation methods force users online and require them to communicate directly with Microsoft’s servers. This means more hardware data, more telemetry, and a tighter ecosystem controlled from Redmond.

The irony is almost comical:
to illegally activate Windows today, you must first introduce yourself to Microsoft.