Microsoft is replacing the certificates that underpin Windows Update, and devices running unsupported versions of Windows will lose access to the service when the old certificates expire next year, BleepingComputer reported Friday. The company has published update deadlines for each supported version, the earliest of which is May 17, 2027.

What Happened

Two certificates used by Windows Update expire on May 17, 2027 and June 19, 2027. Microsoft said such certificates eventually have to be rotated, meaning replaced with new ones, and that devices on unsupported versions of Windows will lose access to Windows Update and stop receiving any updates as a result.

For supported systems, what administrators need to do depends on the version:

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says
  • Windows 11 version 25H2 and later require no action.
  • Windows 11 version 24H2 and Windows Server 2025 must install the September 2025 security update or a later one before June 19, 2027.
  • Other supported versions of Windows 11, Windows 10 and Windows Server 2022 need the July 2026 security update or later before June 19, 2027.
  • Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 need the July 2026 security update or later before May 17, 2027.

All other Windows versions must be upgraded to a supported client or server release to keep receiving updates.

Microsoft said the change does not apply to devices that get their updates through Windows Server Update Services, or WSUS, the on-premises tool many organizations use to approve and distribute patches across their own networks.

Why It Matters

A device that cannot reach Windows Update stops getting security fixes, so any vulnerability disclosed after the cutoff stays open on that machine. For most consumers on Windows 11 the change will pass unnoticed, because the required updates have already been released and install automatically.

The risk is concentrated in fleets that lag on patching or still run releases past their support dates. Servers are a particular concern: Windows Server 2016 and 2019 face the earlier May deadline, and older server installations often run specialized software that organizations are reluctant to update.

Because the required updates for most versions date from July 2026, any machine that has missed patches since early summer would need to catch up before the deadlines to meet Microsoft's requirements.

Context

Windows Update relies on certificates to prove that the update service and the files it delivers are genuine. Like all certificates, they carry expiration dates. A device can trust the replacement certificates only if it has installed an update that includes the new chain of trust, which is why Microsoft ties each deadline to a specific monthly update.

The WSUS exemption means organizations that route patches through their own servers face less immediate pressure from this particular change, though their devices still need regular security updates.

What to Watch

Microsoft's own guidance, "Prepare for Windows Update certificate rotation in 2027," is posted in the Windows release health message center, with the deadlines for each version.

Microsoft advised IT administrators to inventory older devices, keep deploying monthly updates to supported systems and plan upgrades for anything that cannot meet the deadlines. Organizations have until May 17, 2027 for older servers and Windows 10 LTSC machines and until June 19, 2027 for most other systems.

Administrators should also watch for further guidance from Microsoft on how affected devices will behave once the certificates lapse and whether additional tooling will be offered to identify machines at risk.