Microsoft's Windows Update certificate warning
Microsoft has warned administrators and users that a set of Windows Update certificates is scheduled to expire on May 17, 2027, and June 19, 2027, after which devices that have not installed the required updates could lose access to Windows Update services through the affected mechanism. The company framed the change as part of its routine rotation of certificates used to establish trust between client devices and Microsoft update servers, and emphasized that devices meeting the applicable software and update requirements would remain unaffected while older or unsupported systems risk being cut off.
Required patches and deadlines by release
The advisory spells out which cumulative update each in‑support Windows release must be running by the cutoff dates, with the heaviest requirements falling on older and server‑oriented branches. According to the published guidance, Windows 11 25H2 and later require no action, while Windows 11 24H2 and Windows Server 2025 must install the September 2025 security update or any later cumulative update by June 19, 2027; other supported Windows 11 releases and Windows Server 2022 must install the July 2026 security update or a newer release by the same June 19, 2027 deadline; and supported Windows 10 builds must also deploy the July 2026 security update or a newer release by June 19, 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 on the LTSB and LTSC branches face the earlier May 17, 2027 deadline for the July 2026 security update or a newer release.
Devices outside the supported matrix
Microsoft's guidance states that Windows versions not listed in the supported matrix will need to move to a currently supported Windows client or server edition, and that unsupported operating systems are expected to permanently lose Windows Update access if not remediated. Devices running expiring certificates are described as stopping the retrieval of Windows updates entirely until they are patched with builds that include the replacement certificates, and Microsoft is advising IT teams to roll out the required patches through existing device‑management tooling.
Windows Server Update Services carve‑out and administrator steps
The certificate‑rotation change does not apply to machines that obtain updates from Windows Server Update Services (WSUS), allowing administrators using that channel to continue operating without the specific patches tied to the May and June 2027 cutoffs. Even so, Microsoft is recommending that administrators managing large device fleets audit their environments, identify systems needing remediation, and complete the necessary adjustments well before the approaching deadlines, and is pointing IT teams to the Microsoft Update Catalog and existing management tools for patch delivery.
Next milestone
The next verifiable milestone is the earlier of the two certificate expirations on May 17, 2027, which Microsoft has set as the deadline for the July 2026 security update or a newer release on Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 LTSB and LTSC branches, followed by the broader June 19, 2027 cutoff covering Windows 11 24H2, Windows Server 2025, other supported Windows 11 releases, Windows Server 2022, and supported Windows 10 builds.
Share this article
