Windows Update certificates expire in 2027: audit your PCs
Windows Update certificates expire May 17 and June 19, 2027. Unsupported or unpatched PCs lose Windows Update for good. The patch levels each version needs.
The Windows Update certificates that let PCs connect to Microsoft's update servers expire in 2027. Microsoft posted the details on October 8: after the expiry dates, a device without the replacement certificates loses access to Windows Update. No more security patches, no warning in the system tray. For a small business with an old register PC or a forgotten back-office server, this is a quiet way to end up unpatched.
What actually happened
Per Microsoft's Windows message center post, "Prepare for Windows Update certificate rotation in 2027":
- Two expiry dates: May 17, 2027 and June 19, 2027.
- Windows 11, version 25H2 and later: no action needed.
- Windows 11, version 24H2 and Windows Server 2025: install the September 2025 security update or later before June 19, 2027.
- Other in-support Windows 11, Windows Server 2022 and in-support Windows 10: install the July 2026 security update or later before June 19, 2027.
- Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016: install the July 2026 security update or later before May 17, 2027. This group has the earlier deadline.
- Every other Windows version: upgrade to a supported version.
- WSUS: the change does not apply to devices that get updates from Windows Server Update Services.
Most up-to-date devices on a supported version already have the new certificates. BleepingComputer reported the change on October 9.
Why it matters for your business
Big IT shops have patch dashboards. Small businesses have the PC in the back that runs the label printer, the Server 2016 box nobody wants to touch, and the laptop that has been "updating later" since spring. Those are the devices this hits.
The failure is silent. The PC keeps working. It just stops getting fixes, while the exploits for those fixes keep coming.
Do this before spring:
List every Windows device. Run winver on each one and write down the version and build. Include servers, kiosks and point-of-sale terminals.
Check the patch level. Confirm each device has the July 2026 update or later (September 2025 or later for 24H2). Settings, then Windows Update, then Update history.
Mark the May 17 group. Server 2016, Server 2019 and Windows 10 Enterprise 2019 LTSC have the earlier deadline.
Budget the replacements. Anything on an unsupported version needs an upgrade or a replacement. Price it now, not in May.
Key takeaways
- Windows Update certificates expire May 17 and June 19, 2027
- Devices without the replacement certificates lose access to Windows Update
- Most supported versions need the July 2026 update or later; 24H2 needs September 2025 or later
- Server 2016, Server 2019 and Windows 10 Enterprise 2019 LTSC have the earlier May 17 deadline
- Unsupported versions must be upgraded; WSUS-managed devices are not affected
You can't patch a machine you forgot you own. We build simple device inventories and patch-status reports for small teams, so the Server 2016 box in the closet shows up before May. Tell us what's running in your shop, or see what we build.
Sources: Microsoft Windows message center, BleepingComputer.
- #windows-update
- #microsoft
- #patch-management
- #it-security
- #small-business-it
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Senate data center report: AI grid costs land on ratepayers
A Senate data center report says Amazon, Google, Meta and Microsoft don't pay full grid costs. Budget for higher power bills and AI prices.
Read itOpenAI revenue is $50B, not $70B: read your vendor's metrics
OpenAI's annualized revenue is near $50B, not the ~$70B widely reported. The gap is gross vs. net accounting. Read every AI vendor metric the same way.
Read it