Windows Update certificate expiration in 2027: what you must do
Older Windows devices will lose security updates after Microsoft’s certificate expirations in May and June 2027. Find out which versions are affected, the required patches, and how to keep your fleet protected.
Businesses that still run older or unsupported versions of Windows will lose access to the Windows Update service and stop receiving security patches after two certificate expirations in 2027. Microsoft announced the dates, 17 May 2027 and 19 June 2027, and the required actions for each supported release. If you manage a fleet of Windows machines, you need to know which versions are affected and what you must install or upgrade before the deadlines.
Affected Windows versions and deadlines
| Windows version | Required action | Deadline |
|---|---|---|
| Windows 11 25H2 and later | No action required, remains supported through the certificate rotation | , |
| Windows 11 24H2 and Windows Server 2025 | Install the September 2025 security update (or later) | 19 June 2027 |
| Other supported Windows 11, Windows Server 2022 and Windows 10 | Install the July 2026 security update (or later) | 19 June 2027 |
| Windows 10 Enterprise 2019 LTSC, Windows Server 2019, Windows Server 2016 | Install the July 2026 security update (or later) | 17 May 2027 |
| All other Windows versions (including Windows 10 1507‑20H2, Windows 11 21H2‑24H1, etc.) | Upgrade to a supported Windows client or Windows Server version | 17 May 2027 or 19 June 2027, whichever applies |
| Devices that receive updates via Windows Server Update Services (WSUS) | Exempt, continue to receive updates through WSUS | , |
The two certificate expirations are the trigger for the loss of update access. Devices that are not on a supported version or that have not installed the specified security update will be unable to download new patches after the relevant date.
Photo by Christina Morillo on Pexels
Immediate steps for IT teams
- Inventory, Identify every device that is running a Windows version listed above. Use your asset‑management tools or query Active Directory to produce a report.
- Prioritise, Focus first on the versions that have the earlier deadline (May 17 2027). Those include Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016.
- Patch, Deploy the July 2026 security update (or any later update) to the devices in the previous step. Verify that the update is installed successfully.
- Patch later‑deadline versions, For Windows 11 24H2, Windows Server 2025, and the other supported releases, roll out the September 2025 or July 2026 updates as appropriate before 19 June 2027.
- Plan upgrades, Any device that cannot receive the required update must be upgraded to a supported client or server version before the deadline.
- Check WSUS exemption, If you manage updates through Windows Server Update Services, confirm that the WSUS infrastructure is still operational. Devices that rely on WSUS are exempt from the certificate‑expiration block, but you should still keep them patched.
- Monitor, After the certificates expire, verify that devices continue to receive updates. Any that have lost access will appear in the Windows Update logs as unable to contact the service.
What the exemption means
Devices that obtain updates from WSUS are not affected by the certificate rotation. This does not change the need to keep those devices patched; the exemption only preserves the delivery path. Microsoft has not disclosed a detailed rollout schedule for the required security updates, so you should assume the updates will be available as soon as they are released.
Practical advice
- Keep monthly update cycles running on all supported devices, regular patching reduces the risk of missing the critical July 2026 or September 2025 updates.
- For devices that cannot be upgraded before the deadline, consider isolation or additional network controls to limit exposure.
- Document the upgrade path for each legacy version now; the later you start, the tighter the schedule will become.
Photo by panumas nikhomkhai on Pexels
Terms used in this article
- Windows Server Update Services (WSUS), A Microsoft‑provided tool that allows organisations to manage the distribution of updates to Windows computers from an internal server.
- LTSC, Long‑Term Servicing Channel, a version of Windows that receives security updates for an extended period but does not get feature updates.
As a Microsoft partner, Stratum monitors these changes closely and can help you plan the necessary upgrades or patch deployments.
