"As a standard security practice, these certificates have an expiration date. This means that they eventually need to be rotated (that is, replaced by new certificates). A set of these certificates will expire on May 17, 2027 and June 19, 2027," Microsoft said on Thursday.
Microsoft's certificate rotation dates and the immediate effect
Microsoft announced that a set of Windows Update certificates will expire on May 17, 2027 and June 19, 2027. The company warned that devices running unsupported versions of Windows "will lose access to Windows Update services and won't receive any updates as a result." To avoid that outcome, Microsoft said admins and users must upgrade to a supported version of Windows before the certificate expirations.
Required actions mapped to specific Windows releases
Microsoft provided a precise checklist for which update or upgrade action is needed, tied to particular releases and deadlines:
- Windows 11, version 25H2 and later: No action is required.
- Windows 11, version 24H2 and Windows Server 2025: Install the September 2025 security update or later before June 19, 2027.
- Other supported versions of Windows 11, Windows Server 2022, and Windows 10: Install the July 2026 security update or later before June 19, 2027.
- Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Install the July 2026 security update or later before May 17, 2027.
- Other Windows versions: Upgrade to a supported version of Windows client or Windows Server.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogGuidance for IT administrators and operational steps
Microsoft urged IT administrators to take inventory and plan now. Specifically, it advised administrators to identify all devices running older or unsupported Windows versions before the Windows Update certificate rotation in 2027, to deploy monthly Windows updates on all supported devices to keep them current, and to create an upgrade plan for unsupported devices before the May and June 2027 expiration dates. "And if you do need to act on older device populations, there's still time! Review, update, and plan upgrades for unsupported versions before the May 2027 or June 2027 certificate expiration dates," Microsoft added.
Windows Server Update Services (WSUS) — a key exception
Microsoft specified one operational exception: devices that receive updates from Windows Server Update Services (WSUS) are not affected by the certificate rotation notice. WSUS downloads updates and distributes them across enterprise networks, and Microsoft said the certificate expiration advisory does not apply to devices updated via WSUS.
Windows 11, version 26H2 availability and rollout note
Microsoft also noted that it released Windows 11, version 26H2 (the Windows 11 2026 Update) "last month." That release is "now generally available for eligible Windows 11 24H2 and 25H2 systems as a small enablement package (instead of a full OS replacement) in a phased rollout that will expand over the next few months," the company said — a detail that may be relevant for organizations planning upgrades ahead of the 2027 certificate expiration dates.
How IT administrators, WSUS administrators, and end users should respond
IT administrators should inventory devices, confirm which machines match the version-specific update requirements above, and schedule the required security updates well before May 17, 2027 or June 19, 2027. WSUS administrators should note the exemption and continue normal WSUS distribution operations. End users and small organizations that rely on standalone Windows Update services should plan to upgrade to a supported Windows client or server version if they are on "other Windows versions" or on releases that lack the specified security updates before the certificate rotation dates.
Microsoft's advisory ties a routine security maintenance operation — certificate rotation — to calendar deadlines that will determine whether devices keep receiving updates. The company has given concrete update names and two fixed dates; the immediate, tangible task for administrators and users is to match their devices to Microsoft's list and act before May 17, 2027 or June 19, 2027 to avoid losing access to Windows Update services.
