Microsoft has told businesses that Windows devices on unsupported versions will stop receiving updates in 2027. The cause is a routine one: each Windows Update certificate has an expiry date, and Microsoft is replacing them.
The deadlines are 17 May 2027 and 19 June 2027, per Microsoft’s guidance as reported by BleepingComputer on 9 October 2026. If your devices are current, there is little to do. If you have old ones, this is the nudge to sort them out, and you have months, not days.
What is actually changing
Windows Update checks that updates are genuine using digital certificates, much as your browser checks a website. Certificates have an expiry date, so Microsoft rotates them from time to time.
Replacement certificates have already been delivered to devices on supported versions of Windows. Microsoft says a device that is on an unsupported version, or hasn’t installed the recent updates that carry the new certificates, will lose access to Windows Update services and won’t receive any updates as a result.
In plain terms: a PC that has been left unpatched or is too old to be supported could stop being able to patch itself at all.
What each version needs
This is the guidance as published by Microsoft and reported by BleepingComputer (9 October 2026). Check it against your own devices:
Windows 11 version 25H2 and later: nothing to do.
Windows 11 24H2 and Windows Server 2025: install the September 2025 security update or later before 19 June 2027.
Other supported Windows 11 versions, Windows Server 2022 and Windows 10: install the July 2026 security update or later before 19 June 2027.
Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016: install the July 2026 security update or later before 17 May 2027.
Anything older or unsupported: Microsoft’s answer is to upgrade to a supported release.
Microsoft also says the change doesn’t apply to devices that get their updates through Windows Server Update Services (WSUS).
Why this matters even though it is months away
A device that can’t update is a device that gains new weaknesses every month and can’t fix them. It will still switch on and look fine, which is exactly why these devices get forgotten.
It’s also easy to miss. Nobody gets an alert saying a spare laptop in a cupboard is on an old version. The date will arrive whether you’ve counted your devices or not.
This is the same pattern as the Office 2021 end of support, which lands this week. Software ending support is predictable, and the businesses that cope best are the ones with a list.
Five things to do now
Make a list of every PC, laptop and server, with the Windows version each is running. Include the spare, the meeting-room PC and the one on the factory or warehouse floor.
Mark any that are on an unsupported version. Those need replacing or upgrading, and you can plan the budget now rather than in May.
Check that everything else is up to date. The July 2026 update or later is the target for most supported devices.
Find out how your updates are delivered. If you use WSUS or a management tool, ask whoever runs it whether this applies to you.
Put the dates in the diary: 17 May and 19 June 2027.
None of this is difficult. It takes someone with the time to open each device and look, or a monitoring tool that already knows.
What it looks like if you miss it
Nothing dramatic happens on the day. The PC keeps working, and it keeps looking like it is checking for updates. The difference shows up in the months that follow, as fixes for new weaknesses simply fail to arrive.
Microsoft’s guidance notes that supported devices which are behind on updates may be recoverable through other routes, such as the Microsoft Update Catalog or existing management tools. That is a manual job for each machine. It is far easier to install the updates while Windows Update still works.
A note for businesses with servers
Servers are the easiest devices to forget, because nobody sits at them. Windows Server 2016 and 2019 have the earlier date, 17 May 2027, so they come first on your list.
If a server is due for replacement anyway, this is a good reason to move the date forward. If its files and applications could live in the cloud instead, ask whether you need the server at all.
What to do about devices that can’t be upgraded
Some older PCs can’t run a supported version of Windows 11. For those, the realistic options are to replace them or to retire the job they do.
Don’t leave them running on the network simply because they work. An unpatched machine on the same network as your accounts system is a risk to everything around it.
If you aren’t sure what you have, an IT health check will give you the list, and tell you what needs attention first.
Where we come in
Keeping track of which devices need updates, and which need replacing, is part of the managed IT support we provide. If you’d like help with your own device list, speak to Matt. If you’d rather start by looking at what an IT health check covers, that’s a low-commitment first step.
Frequently asked questions
When do the Windows Update certificates expire?
Microsoft has said the certificates expire on 17 May 2027 and 19 June 2027, depending on the Windows version. Devices need the right updates installed before their date.
What happens to a PC that misses the deadline?
Microsoft says devices on unsupported versions will lose access to Windows Update services and won’t receive any updates as a result. Supported devices need to have installed the recent updates that carry the new certificates.
Do I need to do anything if I use Windows 11 25H2?
No. Microsoft says Windows 11 version 25H2 and later need no action.
Does this affect devices managed through WSUS?
Microsoft says the change does not apply to devices that get their updates through Windows Server Update Services. If you aren’t sure how your updates are delivered, ask whoever manages your IT.
