Microsoft says two sets of certificates that Windows Update relies on will expire on May 17, 2027 and June 19, 2027. Supported devices that are current on monthly updates already have the replacements. Devices that fall behind, or run unsupported Windows, will stop getting updates after those dates.
What happened
On October 8, 2026, Microsoft posted "Prepare for Windows Update certificate rotation in 2027" on the Windows IT Pro Blog. The post explains that Windows Update uses certificate-based trust to confirm a device is talking to the real Windows Update servers. The replacement certificates ship through the normal monthly security updates. What you need to do depends on the Windows version:
| Windows version | Action Microsoft lists |
|---|---|
| Windows 11, version 25H2 and later | None |
| Windows 11, version 24H2 and Windows Server 2025 | Install the September 2025 Windows security update or later before June 19, 2027 |
| Other Windows 11 versions in support and Windows Server 2022 | Install the July 2026 Windows security update or later before June 19, 2027 |
| Windows 10 versions in support | Install the July 2026 Windows security update or later before June 19, 2027 |
| LTSB/LTSC releases (2019, 2016) | Install the July 2026 Windows security update or later before May 17, 2027 |
| Other Windows versions | Upgrade to a supported version of Windows |
BleepingComputer lists the earlier-deadline group as Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016. Microsoft says the requirement does not apply to devices that get their updates from Windows Server Update Services (WSUS). After the expiration dates, out-of-date devices lose access to Windows Update services. BleepingComputer adds that unsupported devices won't receive any updates as a result.
Why it matters
This is a trust-anchor rotation, and the failure is easy to miss. A device that can't validate the new certificates doesn't show an outage. It just stops receiving patches. The devices most likely to miss the July 2026 update are the ones nobody is watching: lab machines, kiosks, long-lived servers excluded from patch rings, and old builds that teams keep meaning to retire. Those same devices are where an unpatched vulnerability does the most damage.
The timing also matters. The 2016 and 2019 LTSB/LTSC releases have the earlier date, May 17, 2027. Those builds often run on servers and fixed-function systems with tight change windows. Domain controllers, PKI servers and identity infrastructure on Server 2016 or 2019 fall into that group. Losing patch delivery there is a direct risk to authentication and privileged access, so they shouldn't wait for the June deadline.
The WSUS exclusion covers how clients get their updates. It doesn't mean nothing changes. Microsoft's post doesn't address devices that move between WSUS and direct Windows Update, so treat the WSUS-managed label as something to confirm for each device, not assume.
What to check in your environment
- Pull an inventory of every Windows device by version, edition and installed security update level. Flag anything below the September 2025 update (Windows 11 24H2, Server 2025) or the July 2026 update (all other supported versions).
- Separate out the 2016 and 2019 LTSB/LTSC releases, which BleepingComputer lists as Windows 10 Enterprise 2019 LTSC, Server 2019 and Server 2016. Their deadline is May 17, 2027, about a month earlier than everything else.
- Check each version against Microsoft's supported-versions lists for Windows client and Windows Server, which the post links. Anything out of support needs an upgrade plan, not an update.
- Find devices that patching tools are missing: machines excluded from update rings, update deferrals or pauses that never ended, and systems that are rarely online. Get them onto the July 2026 update or later.
- Record which devices get updates from WSUS and which go directly to Windows Update. Confirm that devices you assume are WSUS-managed actually report to a WSUS server.
- Give owners of servers on the earlier deadline, including domain controllers and certificate authorities, the May 17, 2027 date now so the work fits their change windows.
- Subscribe to Windows release health and Microsoft's discussion thread for this rotation (linked below) for any updates to the guidance.
References
- Microsoft Windows IT Pro Blog: Prepare for Windows Update certificate rotation in 2027
- BleepingComputer: coverage of the Windows Update certificate expiration (October 9, 2026)
- Microsoft Learn: Supported versions of Windows client
- Microsoft Learn: Windows Server release information
- Microsoft discussion board: Windows Update 2027 certificate rotation