Microsoft is warning organizations that certain Windows systems will no longer be able to receive updates starting in May 2027. The reason is the expiration of security certificates that Windows Update uses to verify the authenticity of Microsoft’s update servers. Systems that are behind on security updates are particularly at risk.
The certificates in question expire on May 17 and June 19, 2027. Microsoft has since included the replacement certificates in regular security updates. For computers and servers that have installed these updates, nothing will change. However, systems that have not been updated may lose access to Windows Update once the certificates expire.
This means that not only will new security updates be withheld, but also other updates that Microsoft distributes through this service.
Supported Windows versions also affected
The problem is not limited to outdated Windows installations. Systems running a version of Windows that is still supported may also be affected if the necessary updates are missing.
For Windows 11 24H2 and Windows Server 2025, the September 2025 security update or a later version is sufficient. Windows Server 2022, supported versions of Windows 10, and other supported Windows 11 versions must have received at least the July 2026 security update.
For Windows Server 2016, Windows Server 2019, and Windows 10 Enterprise 2019 LTSC, the earliest deadline is May 17, 2027. For the other systems mentioned, the deadline is June 19, 2027. According to Microsoft, Windows 11 25H2 and newer versions do not require any additional measures.
The certificate replacement is separate from the regular Windows support cycle. For example, Windows 10 systems can still receive security updates through the Extended Security Updates (ESU) program, but these systems must also have the correct certificates.
Administrators must take inventory of systems
Microsoft advises IT administrators to check which devices are behind on updates. Systems that are not updated automatically due to business-critical applications or specific configurations deserve special attention.
Those who miss the deadline can still manually install the necessary updates via the Microsoft Update Catalog or existing management tools. According to Microsoft, systems running a Windows version that is no longer supported must be migrated to a supported operating system.
This warning does not apply to devices that receive their updates via Windows Server Update Services (WSUS).