Out-of-date Windows PCs will lose Windows Update in 2027 when its certificates expire
Certificates that Windows uses to verify Windows Update servers expire on May 17 and June 19, 2027, and devices without the replacements will stop receiving all updates, Microsoft warns. Windows 11 25H2 needs no action; 24H2 and Windows Server 2025 need the September 2025 update or later, and most other supported versions the July 2026 update or later. WSUS-managed devices are not affected.
Windows Update uses certificates to confirm devices are talking to genuine Microsoft update servers. A set of them expires on May 17, 2027 and June 19, 2027, depending on the Windows version, and Microsoft is distributing replacement certificates through regular monthly updates. Devices that don't have them by the deadline will stop connecting to Windows Update and receiving any kind of update.
Windows 11 version 25H2 and later need no action. Windows 11 24H2 and Windows Server 2025 need the September 2025 security update or later, and other supported Windows 11 versions, Windows Server 2022 and supported Windows 10 versions need the July 2026 update or later, both before June 19, 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 need the July 2026 update before May 17, 2027. Unsupported versions will lose access and should be upgraded.
Supported devices that miss the deadline can regain access by installing the required update, which admins can download from the Microsoft Update Catalog or push through their management tools. Devices that get updates from Windows Server Update Services (WSUS) are not affected by the change.
Sources
- Microsoft Windows IT Pro Blog: Prepare for Windows Update certificate rotation in 2027 techcommunity.microsoft.com