Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE
CybersecurityImportant

Windows Update certificates change: PCs that aren't updated will lose patches in 2027

Microsoft warns that Windows Update certificates expire on May 17 and June 19, 2027. PCs and servers not updated by then will no longer receive any security updates.

By Frédéric LENQUETTESenior Cybersecurity Consultant at Orange Cyberdefense

2 min read

Translated from French by AI. The original French article is the reference version.

AI-generated illustration

On Thursday, October 8, Microsoft published an administrator advisory (reference MC1491763) announcing the replacement of the certificates that let devices establish a trusted connection with Windows Update. The current certificates expire on May 17, 2027 or June 19, 2027, depending on the Windows version. A device without the new certificates on those dates will lose access to Windows Update and will receive no further updates, including security updates.

Who needs to do what?

The new certificates have already been distributed to supported systems. Those that install their updates regularly have nothing special to do. For the others, here is Microsoft's timeline:

  • Windows 11 25H2 and later versions: no action required.
  • Windows 11 24H2 and Windows Server 2025: install the September 2025 security update or a later one before June 19, 2027.
  • Other supported versions of Windows 11, Windows Server 2022 and Windows 10: install the July 2026 update or a later one before June 19, 2027.
  • Windows 10 Enterprise LTSC 2019, Windows Server 2019 and Windows Server 2016: install the July 2026 update or a later one before May 17, 2027.
  • Unsupported versions: they will lose access to Windows Update in all cases. Microsoft recommends upgrading to a supported version.

Devices updated through WSUS (Windows Server Update Services), the internal update server used by many companies, are not affected by this change.

Why it matters

The main risk concerns forgotten machines: a 2016 server that was never restarted, a standalone PC in a workshop, a PC that has not run its updates in months. After the deadline, these devices will not be able to catch up through the usual channel. They will remain exposed to every vulnerability discovered afterward, and the warning may not be visible.

What to do?

  1. Take inventory of Windows PCs and servers, identifying old or unsupported versions.
  2. Check that monthly updates are actually installing on supported devices, especially 2016 and 2019 servers, whose deadline comes earlier.
  3. Plan the migration now of unsupported systems, before May 2027.
  4. For SMEs without an IT department: open Windows Update on each PC, install everything on offer and restart.

Method: AI-assisted monitoring, verified sources, article reviewed and approved by Frédéric LENQUETTE.

Share this article