Unsupported Windows installations face a hard deadline: they will be unable to receive security updates once Microsoft rotates its Windows Update certificates in 2027. The company announced Thursday that administrators and end users must migrate to a currently supported Windows version before the certificate expiration dates arrive.

Microsoft explained the reasoning behind the move: "As a standard security practice, these certificates have an expiration date. This means that they eventually need to be rotated (that is, replaced by new certificates). A set of these certificates will expire on May 17, 2027 and June 19, 2027."

Devices stuck on unsupported Windows releases "will lose access to Windows Update services and won't receive any updates as a result," according to Microsoft, which urged organizations to "upgrade to a supported version of Windows client or server."

The company noted in a separate Microsoft 365 Message Center notification that replacement certificates have already been distributed to systems running supported Windows versions. No further action is needed for these machines if they remain current with patches.

Update Requirements by Windows Version

Microsoft provided specific guidance for each Windows edition:

  • Windows 11, version 25H2 and later: No action is required.
  • Windows 11, version 24H2 and Windows Server 2025: Install the September 2025 security update or later before June 19, 2027.
  • Other supported versions of Windows 11, Windows Server 2022, and Windows 10: Install the July 2026 security update or later before June 19, 2027.
  • Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Install the July 2026 security update or later before May 17, 2027.
  • Other Windows versions: Upgrade to a supported version of Windows client or Windows Server.

Recommended Actions for IT Teams

Microsoft advised IT administrators to begin auditing their environments now to locate all machines running older or unsupported Windows editions before the 2027 certificate rotation takes effect.

The company recommended that organizations deploy monthly Windows updates across all supported devices to maintain currency and develop an upgrade strategy for machines on unsupported versions before the May and June 2027 deadlines. "And if you do need to act on older device populations, there's still time! Review, update, and plan upgrades for unsupported versions before the May 2027 or June 2027 certificate expiration dates," Microsoft stated.

One important caveat: this certificate rotation does not affect devices receiving updates through Windows Server Update Services (WSUS), which allows enterprises to download and distribute updates internally across their networks.

Latest Windows Release

Last month, Microsoft released Windows 11, version 26H2 (the Windows 11 2026 Update), which is now available to eligible Windows 11 24H2 and 25H2 systems. Rather than requiring a full operating system reinstall, the update is being delivered as a small enablement package in a staged rollout expected to reach all qualifying machines over the coming months.