Windows Update Certificates Expire in 2027, and Unsupported PCs Will Be Cut Off
Microsoft says devices on unsupported Windows versions will lose access to Windows Update when signing certificates expire in May and June 2027. Here is what to install, by version, and how layered defenses help.
Here Is How Layered Defenses Help
Every business has that one PC: the old machine in the back office that runs fine, never gets upgraded and quietly keeps taking updates. Next year that changes. Microsoft has set a hard date after which unsupported Windows systems won’t get updates at all, not even the occasional fix.
Why the cutoff is happening
Windows Update relies on certificates, and as a routine security measure they expire and have to be replaced. Microsoft said on Thursday, October 8, that one set expires on May 17, 2027, and another on June 19, 2027. Devices on supported versions have already received the replacements and need nothing more if they are current. Devices on unsupported versions, Microsoft says, will lose access to Windows Update and stop receiving updates.
Sergiu Gatlan broke down Microsoft’s notice for BleepingComputer, including the version-by-version requirements below.
What each version needs
- Windows 11, version 25H2 and later: Nothing to do.
- Windows 11, version 24H2 and Windows Server 2025: The September 2025 security update or later, installed before June 19, 2027.
- Other supported Windows 11 versions, Windows Server 2022 and Windows 10: The July 2026 security update or later, before June 19, 2027.
- Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016: The July 2026 security update or later, before the earlier date, May 17, 2027.
- Everything else: Upgrade to a supported Windows client or server version.
Microsoft’s advice to IT teams is to find every device on an old or unsupported version now, keep monthly updates flowing to supported machines and build an upgrade plan for the rest before the deadlines. BleepingComputer notes the guidance doesn’t apply to devices that get their updates through Windows Server Update Services (WSUS).
Here is how layered defenses help
An unpatched PC is a hole in your first line of defense, but it shouldn’t be the only thing standing between an attacker and your data. While you work through upgrades, layer protections around the machines that are lagging:
- Inventory and update management. Your endpoint management tool, such as Microsoft Intune or a comparable RMM platform, should report the Windows version and last update of every device so nothing gets missed.
- Endpoint protection. A modern endpoint detection and response product, such as Microsoft Defender for Endpoint or a similar tool, can catch attacks that target unpatched flaws.
- Network segmentation. Put any machine you can’t upgrade yet on its own network segment with only the access it truly needs.
- Identity controls. Multifactor authentication and least-privilege accounts limit what an attacker can do from a compromised PC.
- Backups. Regular, tested backups stored away from the network mean a compromised old device doesn’t become a business-wide outage.
What this means for your company
Mid-2027 sounds far away, but hardware budgets, line-of-business software testing and staff schedules all take time. Use the next few months to count your machines, flag anything that won’t make the cut, and budget for replacements now instead of in May 2027. Pay special attention to Windows Server 2016 and 2019 and Windows 10 LTSC systems. They face the earlier deadline and often run critical applications nobody wants to touch.
Need help building a Windows upgrade plan, or protecting the systems you can’t replace yet? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
