Windows PCs that do not receive Microsoft's replacement certificates will lose access to Windows Update altogether when the current ones expire on May 17 and June 19, 2027. Microsoft announced the rotation on October 8 in message center post MC1491763, titled "Prepare for Windows Update certificate rotation in 2027." Most PCs that stay up to date will never notice, but older machines and Windows 10 PCs outside the paid security programme are at risk (BleepingComputer).
What is changing
Windows checks that it is talking to genuine Microsoft update servers by validating certificates, and those certificates expire. Microsoft calls the replacement standard security practice, and the new certificates have already been delivered to supported Windows versions through normal monthly updates. A PC without them loses access to Windows Update: no security patches and no feature updates. Devices on unsupported Windows versions lose access too, and the only advice for them is to upgrade.
Which PCs need to do something
| Windows version | What to do | Deadline |
|---|---|---|
| Windows 11 25H2 and later | Nothing | Not applicable |
| Windows 11 24H2, Windows Server 2025 | Install the September 2025 security update or later | June 19, 2027 |
| Other supported Windows 11, Windows 10, Windows Server 2022 | Install the July 2026 security update or later | June 19, 2027 |
| Windows 10 LTSB/LTSC, Windows Server 2016 and 2019 | Install the July 2026 security update or later | May 17, 2027 |
| Unsupported Windows versions | Upgrade to a supported version | Updates stop at expiry |
Devices updated through Windows Server Update Services (WSUS) are not affected. Microsoft is also moving consumer Windows 11 24H2 PCs to 25H2 automatically.
Who is most exposed
The biggest risk group is Windows 10 PCs without Extended Security Updates. Windows 10 stopped getting regular patches in October 2025, so machines that never enrolled in ESU never received the July 2026 update carrying the certificate. Enrolment in ESU stays open until October 2027, and a PC enrolled before June that installs the offered updates counts as supported. Machines that simply have not been updated for months are also exposed (PCWorld).
How to check your own PC
1. Type winver into the taskbar search to see your Windows version.
2. Open update history: Settings, Windows Update on Windows 11, or Update and Security on Windows 10.
3. Look for a cumulative update from July 2026 or newer. If it is missing, run a manual check for updates.
4. If Windows Update does not offer it, download the package manually from the Microsoft Update Catalog.
Why it matters
An expired certificate is a quiet failure. Nothing breaks on the day; the PC simply stops hearing from Microsoft and can stay unpatched against new vulnerabilities without warning. An old Windows 10 laptop kept in a drawer for occasional use is the likeliest to be caught, so switch such machines on and update them well before May 2027.
What to watch next
Reminders inside Windows as the dates approach, guidance for businesses that manage their own update servers, and whether Microsoft offers any fallback for PCs that miss the deadline.
