Windows Update Certificates Expire in 2027: Which Devices Need Action and What to Install

Illustration of a supported Windows PC receiving updates while an unsupported PC loses access after certificate expiry

Windows devices that are no longer supported will lose access to Windows Update in 2027. Microsoft says a set of Windows Update certificates expires on May 17, 2027 and June 19, 2027, and PCs on unsupported versions will stop receiving any updates once the certificates are rotated. If you already run into Windows 11 update problems, this is one more reason to keep your systems current.

Here is who is affected, the exact deadlines, and what to do before they arrive.


What Is Happening

Certificates used by Windows Update have an expiration date as standard security practice, so they are periodically replaced. Microsoft says devices on unsupported versions of Windows "will lose access to Windows Update services" and will not receive updates after the rotation. A separate Microsoft 365 Message Center note says the replacement certificates have already been delivered to supported Windows versions and need no extra action if the device is up to date.

  • Key dates: May 17, 2027 and June 19, 2027.
  • Who loses updates: Devices on unsupported Windows client or server versions.
  • Fix for unsupported devices: Upgrade to a supported Windows version.

What You Need to Do, by Windows Version

Windows Version Required Action Deadline
Windows 11 25H2 and later No action required None
Windows 11 24H2, Windows Server 2025 Install the September 2025 security update or later Before June 19, 2027
Other supported Windows 11, Windows Server 2022, Windows 10 Install the July 2026 security update or later Before June 19, 2027
Windows 10 Enterprise 2019 LTSC, Windows Server 2019, Windows Server 2016 Install the July 2026 security update or later Before May 17, 2027
Any other Windows version Upgrade to a supported Windows client or Server version Before May and June 2027
Note for enterprises: The announcement does not apply to devices that receive updates from Windows Server Update Services (WSUS), which distributes updates across enterprise networks.

Step-by-Step: Get Ready

1. Check your Windows version

On a single PC, press Win + R, type winver, and press Enter. Compare the version and build against the table above.

2. Install the latest updates

Open Settings, go to Windows Update, and select Check for updates. Installing the current monthly update covers the minimum requirement for every supported version in the table. If updates stall, see our Windows 11 slow boot guide for general troubleshooting that often helps on older machines.

3. Plan upgrades for unsupported devices

For IT teams, Microsoft advises three steps: identify every device running an older or unsupported version, deploy monthly updates on all supported devices, and build an upgrade plan before May and June 2027. Windows 11 version 26H2, also called the Windows 11 2026 Update, is rolling out in phases as a small enablement package for eligible 24H2 and 25H2 systems.

Security warning: A PC that cannot reach Windows Update stops getting security patches. Do not keep an unsupported system on the internet for browsing, email, or banking. If you cannot upgrade it, isolate it from your main network.

Why This Matters

Much of the risk with old Windows PCs comes from them quietly falling behind. After this rotation, unsupported devices will not simply be unpatched, they will lose access to Windows Update altogether. Microsoft is giving roughly a year of notice, which makes this a planning task rather than an emergency. Home users with aging hardware should also check whether their PC can run a supported version before the deadline. If it cannot, replacing it is safer than running it unpatched. Keeping a system lean also helps, so our guide to fixing high RAM usage in Windows 11 is a good follow-up.

Official source: Microsoft Windows message center, plus the lists of supported Windows client versions and Windows Server releases.


Frequently Asked Questions (FAQ)

When do the Windows Update certificates expire?

A set expires on May 17, 2027 and another on June 19, 2027, according to Microsoft.

What happens to unsupported Windows devices?

They will lose access to Windows Update services and will not receive any updates after the certificate rotation.

Do I need to do anything on Windows 11 25H2?

No. Windows 11 version 25H2 and later require no action.

Does this apply to WSUS-managed devices?

Microsoft says it does not apply to devices that receive updates from WSUS.

What should IT administrators do now?

Identify all older or unsupported devices, deploy monthly updates on supported ones, and plan upgrades before the May and June 2027 dates.


Focus Keywords / Tags: Windows Update certificate expiration, unsupported Windows, Windows 10 end of support, Windows 11 26H2, Windows Server 2016 update, security updates 2027, WSUS, TechFixGrid

No comments:

Post a Comment