Microsoft is warning users that some Windows PCs could lose access to Windows Update in 2027 if they remain on outdated software. The issue is tied to digital certificates used by Windows Update to establish secure connections between a device and Microsoft's update infrastructure. Once those certificates expire, systems that have not received the newer replacements may no longer be able to communicate with Microsoft's update servers.
For affected users, this could become a serious security problem. A PC that can no longer reach Windows Update will stop receiving security patches, bug fixes and other important system updates. The good news is that Microsoft is already distributing the replacement certificates through normal monthly security updates, so most users simply need to make sure their systems are properly patched before the deadlines arrive.
Two Important Deadlines In 2027
Microsoft has identified two key dates depending on which version of Windows is installed. The earlier deadline is 17 May 2027, which applies to systems running:
A second deadline will follow on 19 June 2027 for:
After the relevant certificate expires, a device that does not already have the replacement certificate may no longer be able to connect securely to Windows Update.
Why The Certificates Matter
Digital certificates are used to help verify that a computer is connecting to legitimate Microsoft infrastructure and that the communication between the device and the update service is secure. These certificates have expiration dates, just like many other security credentials.
Normally, users never need to think about them because Microsoft renews or replaces the necessary certificates through regular updates. The problem appears when a device has gone for a long period without installing updates. If the old certificate expires before the replacement is installed, the machine could effectively lose the ability to retrieve the very update that would have fixed the problem.
That creates a situation where being too far behind on updates can make catching up considerably more difficult.
Most Users Do Not Need To Do Anything Special
There is no separate certificate installer that users need to download manually. Microsoft is already bundling the replacement certificates into normal security updates. For people who routinely install monthly patches, the transition should happen automatically.
Windows 11 systems running version 25H2 or later require no additional action. These systems already contain the necessary changes as part of their normal servicing.
Windows 11 24H2 and Windows Server 2025 need to have at least the September 2025 security update installed. Older supported Windows and Windows Server versions will generally need at least the July 2026 security update.
In other words, the solution for most users is straightforward: keep Windows updated.
Windows 10 Users Face A Bigger Risk
Windows 10 devices present a more complicated situation because standard support for the operating system ended last year. Machines that are no longer receiving updates will not automatically receive the replacement certificates required for continued Windows Update connectivity.
This makes unsupported Windows 10 systems particularly vulnerable. A machine may continue working perfectly well today, but if it remains unpatched until the June 2027 certificate deadline, it could eventually lose access to Microsoft's update service entirely.
For users who still need to remain on Windows 10, Microsoft's Extended Security Updates programme becomes especially important.
Windows 10 ESU Remains Available Until October 2027
The Extended Security Updates, or ESU, programme gives eligible Windows 10 users additional time to receive important security patches after the end of normal support. Microsoft says the programme will remain available until October 2027.
This means Windows 10 users still have time to enrol and obtain the required updates before the June certificate deadline. However, waiting until after access to Windows Update is already broken could make the situation much more difficult.
Anyone planning to remain on Windows 10 through 2027 should therefore make sure the device is enrolled in ESU and fully updated before the certificate changes take effect.
Unsupported Windows Versions Have Fewer Options
For systems running Windows releases that are already unsupported and do not qualify for an extended update programme, the situation is much simpler: upgrading is effectively the only practical option.
Older Windows versions may lack both the updated certificates and the servicing infrastructure necessary to receive them. Even if the computer itself continues to function, staying on an unsupported operating system means missing critical security patches and potentially losing access to update services altogether.
At that point, upgrading the operating system or replacing hardware that cannot support a newer Windows release becomes the safer long-term choice.
Why Losing Windows Update Is A Serious Security Risk
Windows Update does much more than introduce new features. It delivers security patches for vulnerabilities that could otherwise be exploited by malware, ransomware or remote attackers. A machine that permanently loses access to those updates becomes increasingly vulnerable over time.
The risk grows as newly discovered vulnerabilities accumulate. Attackers often target systems that remain on known vulnerable software because exploitation tools become more widely available after security fixes are published.
A PC that stops receiving updates may therefore continue working normally while its security posture quietly deteriorates.
Businesses Should Pay Particular Attention
The warning is especially important for organisations managing large numbers of older PCs or servers. Enterprise environments often contain systems that have been intentionally excluded from normal update cycles because of compatibility requirements, specialised software or operational concerns.
Those machines are precisely the ones most likely to miss the replacement certificates. IT teams should therefore review patch compliance well before the 2027 deadlines rather than assuming that every system will update automatically.
Windows Server 2016, Windows Server 2019 and long-term servicing versions of Windows 10 deserve particular attention because they may remain deployed in production environments long after mainstream desktop systems have moved on.
Check Systems Before The Deadline
Users and administrators should make sure their devices have received the minimum required updates well before May or June 2027. Waiting until the final weeks increases the risk of discovering that a system has additional update problems or cannot reach Microsoft's servers properly.
For managed business environments, checking update compliance across the entire fleet would be more effective than relying on individual users. Systems that have been offline for long periods, rarely used laptops and older servers should be included in that review.
The important point is to install the required certificate updates while Windows Update still works normally.
Final Thoughts
Microsoft's 2027 certificate expiry is unlikely to affect users who keep Windows regularly updated. Replacement certificates are already being distributed through normal security patches, so current Windows 11 systems and properly maintained Windows Server installations should transition without much disruption.
The biggest risk is for PCs that have fallen significantly behind on updates, particularly unsupported Windows 10 systems that are not enrolled in Extended Security Updates. Once the old certificates expire, those devices may no longer be able to communicate with Windows Update at all.
For anyone still running an older Windows installation, the message is simple: update while you still can. A few missed patches today could become a much larger problem once the certificate deadlines arrive in 2027.
Comments 0