Cut-paper illustration of a blue shield with rotation arrows representing a Windows Update server, connected by dotted lines to paper laptops and desktops, beside a cracked wax-seal certificate and a paper calendar

Microsoft put a date on something most of us never think about. On October 8, the Windows IT Pro Blog announced that the certificates Windows Update uses to prove your PC is talking to the real Microsoft servers will expire on May 17 and June 19, 2027. Any supported machine that keeps taking its monthly updates will sail through. Any machine that doesn't could lose Windows Update itself — not just fall behind on patches, but lose the ability to pull them at all.

Nothing breaks today. That is exactly why this one deserves attention now instead of later.

What is actually happening

Windows Update does not just download files from a URL and trust them. It uses certificate-based trust to confirm the device is connecting to authoritative Windows Update servers, so the content it delivers is genuine. Like all certificates, these have an expiration date, and rotating them — replacing the old with the new — is standard security practice.

Microsoft is delivering the replacement certificates through ordinary monthly quality updates. If your machines are current, they likely already have them and there is nothing to do. The machines at risk are the ones that stopped taking updates a while ago, plus anything running a version Microsoft no longer supports.

Which machines are at risk

Microsoft published an action table by Windows version. Here it is, condensed:

Windows version What it needs Deadline
Windows 11, 25H2 and later Nothing —
Windows 11, 24H2 and Windows Server 2025 September 2025 security update or later June 19, 2027
Other supported Windows 11, Windows Server 2022, supported Windows 10 July 2026 security update or later June 19, 2027
Windows 10 Enterprise 2019 LTSC, Windows Server 2019, Windows Server 2016 July 2026 security update or later May 17, 2027
Anything out of support Upgrade to a supported release Before the certs expire

Two details worth noticing. First, the 24H2 row asks for an older update (September 2025) than every other row (July 2026). That reads backwards until you realize the replacement certs were simply baked into 24H2's update stream earlier. Second, the May 17 deadline hits the older server editions and the 2019 LTSC a full month before everyone else. If you still have a Server 2016 box in a back room somewhere, its clock runs out first.

One more exclusion, straight from Microsoft: this does not apply to devices receiving updates from WSUS. Those machines get their trust story through the WSUS infrastructure instead.

The machines that worry me most

If you work at an MSP or manage any fleet with history, you already know the shape of the at-risk list. It is not the laptops that check in every day. It is:

  • The front-desk PC that has been "about to finish updating" for six months.
  • The server kept on an old build because one line-of-business app needs it there.
  • The Windows 10 machines that never enrolled in Extended Security Updates. Their last update was October 2025. The July 2026 update Microsoft requires was never offered to them, which puts them functionally in the "upgrade" bucket even though the table lists Windows 10 as supported.
  • Anything with updates paused, disabled by policy, or broken by a long-dead WSUS pointer.

The failure mode here is quiet, and that is the dangerous part. Nothing errors out in 2026. In mid-2027 these machines simply stop connecting to Windows Update. No new patches, no security fixes, no noise. An unpatched machine nobody is watching is exactly what attackers look for, and this deadline manufactures a whole population of them at once.

How to find them

Microsoft's own action plan starts where every good troubleshooting run starts: identify the devices running older or unsupported versions. Here is a quick read-only check you can run against a machine right now:

$info = Get-ComputerInfo
[pscustomobject]@{
Product   = $info.WindowsProductName
Version   = $info.WindowsVersion
Build     = $info.OsBuildNumber
LastPatch = (Get-HotFix |
Sort-Object InstalledOn -Descending |
Select-Object -First 1).InstalledOn
}

That gives you the four facts that matter: what it runs, which build, and when it last took a patch. Run it across the fleet however you normally reach machines — remote PowerShell sessions, your RMM, a logon script writing to a share — and sort the results against the table above. Anything whose last patch predates the required update for its version goes on the remediation list. Anything out of support goes on the upgrade list.

If you have Intune, the update compliance reports will show you the same thing with less scripting. If you are on WSUS, remember the exclusion: WSUS-serviced devices are not affected by this rotation, but audit them anyway, because a WSUS client that has not actually pulled updates in a year has bigger problems than certificates.

Do this once now, then put a recurring check on it quarterly. The deadline is 19 months out, which is plenty of time if you start from an accurate list and no time at all if you start from assumptions.

What to do with the list

Microsoft's plan is three steps, and it is the right three steps:

  1. Identify devices on older or unsupported versions.
  2. Keep supported devices current with monthly updates.
  3. Build the upgrade plan for unsupported devices before May and June 2027.

For supported machines that are merely behind, the remediation is the required update itself, pulled from the Microsoft Update Catalog or pushed through your normal management tools. For unsupported machines, there is no update that fixes this — the only path Microsoft lists is upgrading to a supported client or server release. Budget for those now, while there are still quarters left to spend it in.

The durable point

Certificate expirations are not new. What makes this one worth a post is the shape of the consequence: the update mechanism itself is what breaks. Every other patching failure you have ever dealt with was a machine falling behind. This one is a machine losing the ability to catch up through the normal channel. The fix is the most boring thing in IT — keep patching — applied to the machines everyone forgot. Audit them now, while the deadline is a planning item instead of an incident.

Sources