Your PC could lose every type of Windows Update download in 2027 simply because its security certificates expire. The Windows Update certificate expiration dates are May 17 and June 19, 2027, and supported PCs with current updates already have the replacements. According to Microsoft’s Windows IT Pro Blog announcement, outdated or unsupported installations face losing access, so here’s what matters for your machine.
| Detail | What we know |
|---|---|
| Announced | October 8, 2026, through Windows release health and notice MC1491763 |
| Expiry dates | May 17, 2027 and June 19, 2027 |
| What breaks | Windows Update connectivity, affecting every update category |
| Who is safe | Windows 11 25H2 and newer, including 26H2, plus supported PCs receiving current monthly updates |
| Earliest deadline | May 17 for Windows 10 Enterprise 2019 LTSC, Server 2019 and Server 2016 |
| Not affected | Devices receiving updates through WSUS |
| Fix for unsupported PCs | Upgrade to a supported Windows release |
What Microsoft Is Changing and Why
You see, your PC needs to verify who it’s talking to before trusting an update. Windows Update uses digital certificates to authenticate Microsoft’s servers and establish trust in the content you receive. Those certificates have expiry dates as part of routine security practice, which brings us to what Microsoft is replacing.
- Certificate replacement. Microsoft calls the process rotation. Your device needs the replacement certificates to maintain its trusted connection once the existing ones expire in May or June 2027.
- Delivery through regular patches. Microsoft has already included the replacements in monthly security updates. If your supported PC has kept up with those releases, you don’t need a separate certificate installation.
- Public notices. Microsoft announced the change on October 8, 2026, through Windows release health, Microsoft 365 Message Center notice MC1491763 and a Tech Community discussion. These notices identify which Windows releases need attention.
- Feedback channel. If you manage affected devices, Microsoft directs feedback to its certificate rotation discussion board.
The practical question is whether your Windows release has received the update that carries those replacements. Your version determines both the minimum patch and the date you need to beat.
Deadlines for Every Windows Version
Don’t assume every PC has until June. Some older enterprise and server releases face a May deadline, while Windows 11 25H2 and newer require no action for this change. Find your release below to see which update you need before its certificates expire.
| Windows version | Minimum update | Deadline |
|---|---|---|
| Windows 11 25H2 and later, including 26H2 | None required for this change | No action required |
| Windows 11 24H2 and Windows Server 2025 | September 2025 security update or newer | Before June 19, 2027 |
| Other supported Windows 11 releases, Windows Server 2022 and supported Windows 10 releases | July 2026 security update or newer | Before June 19, 2027 |
| Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 | July 2026 security update or newer | Before May 17, 2027 |
| Other Windows releases outside support | Upgrade to a supported release | Before the applicable May or June 2027 expiry |
- Check the update month. Microsoft’s certificate notice doesn’t identify individual KB numbers. It specifies a minimum security update month, with later updates accepted.
- Windows 11 26H2 is included. Its rollout began September 29, 2026, using an enablement package. It falls within Microsoft’s 25H2-and-later group, so no certificate-specific action is required.
- Check business update delivery. If your device gets its updates through Windows Server Update Services, or WSUS, this certificate change doesn’t apply to it.
These are minimum requirements for keeping the connection working. If your PC misses its date, the recovery options depend on whether your Windows release remains supported.
What Happens to PCs That Miss the Date
Missing the deadline doesn’t put every PC in the same position. Your Windows support status and installed updates determine whether service continues or you need to intervene. Here’s how the three groups differ.
Supported and Current PCs
If your supported PC already has the required updates, Windows Update continues without interruption. The replacement certificates are already installed, so there’s no separate repair to perform when the old ones expire.
Supported PCs That Fell Behind
If your supported PC lacks the replacements, it loses its Windows Update connection after the relevant deadline. That cuts off all update categories, rather than security patches alone.
You can restore access by installing the required update from the Microsoft Update Catalog. If you manage business devices, you can also distribute that update through your usual management tools.
Unsupported PCs
If your Windows release is outside support, Microsoft says it will lose Windows Update access and receive no further updates through the service. Upgrading to a supported release is the only remedy Microsoft lists for this group.
Eleven Forum members have asked whether manual Catalog installations or separate Defender definition downloads could help unsupported PCs. Microsoft hasn’t confirmed those possibilities, so you shouldn’t count on them as a recovery plan.
Losing security updates leaves your PC exposed to vulnerabilities those patches would address, the kind of flaws researchers keep finding at events such as Pwn2Own Ireland 2026 and in alerts like the FBI’s FortiBleed warning. Checking your version and update history now gives you time to act before access disappears.
How to Check Your Windows Version and Get Current
You don’t need to inspect individual certificates to find out whether your PC needs attention. Your Windows version and update history tell you which deadline applies and whether you’ve received the required patch. Work through these checks before deciding whether you need an update or an upgrade.
- Find your Windows version. Type winver into the taskbar search box and open the result. Note the version and build number so you can compare your installation with Microsoft’s requirements.
- Match your release to the deadline table. Windows 11 25H2 and newer need no certificate-specific action. For other supported releases, check both the minimum update month and whether your deadline falls in May or June 2027.
- Open Windows Update. On Windows 11, go to the Windows Update page. On Windows 10, open Update & Security, then select Windows Update to reach the controls for checking and installing patches.
- Review your update history. Look for a security or cumulative update from July 2026 or newer. Windows 11 24H2 and Server 2025 have an earlier minimum requirement of September 2025.
- Install pending updates. Select Check for updates, install the available updates and restart your PC. If your supported installation has fallen behind, this brings in the replacement certificates through the regular patch process.
- Use the Catalog if necessary. If the required update isn’t offered, you can obtain it through the Microsoft Update Catalog. This is also Microsoft’s recovery route for supported PCs that miss the certificate deadline.
- Check how business devices receive updates. If you manage PCs, confirm whether they use WSUS, which is excluded from this change. Identify older installations separately so you can plan their updates or upgrades.
If you’re still using Windows 10, there’s another detail to check. Your ESU enrollment can determine whether you receive the patch you need.
Windows 10 Owners and the ESU Factor
Your Windows 10 PC may need more than another click on Check for updates. Regular support ended on October 14, 2025, and PCs without Extended Security Updates, or ESU, haven’t received the July 2026 patch carrying the replacement certificates. For eligible personal PCs, these are your enrollment choices.
| Option | Cost |
|---|---|
| Use Windows Backup to sync your PC preferences | Free |
| Redeem Microsoft Rewards points | 1,000 points |
| Purchase consumer ESU | $30 plus applicable tax |
Consumer ESU now runs through October 12, 2027, following an extension that appeared in Microsoft’s documentation in June 2026. You can enroll until the program ends, and one license covers as many as 10 devices. If you’re already enrolled, your coverage continues automatically.
But don’t confuse the enrollment closing date with your certificate deadline. To receive the replacements before Windows Update access is interrupted, enroll and install the offered updates before June 19, 2027. Check these requirements first.
- Eligible edition. Your PC must run Windows 10 22H2 Home, Pro, Pro Education or Pro for Workstations.
- Required updates. You need the latest updates and the ESU licensing preparation package identified as KB5126256.
- Account access. Enrollment requires a Microsoft account with administrator rights. A child account doesn’t qualify.
- Personal use. Consumer ESU isn’t available for commercial use, kiosk devices or PCs joined to an Active Directory domain or Microsoft Entra, or enrolled in mobile device management.
To enroll, open Update & Security, select Windows Update and choose Enroll now. If you use a local account, you’ll be asked to sign in with a Microsoft account.
ESU gives you critical and important security fixes, without new features. It buys you more time to move on, and enrolling doesn’t prevent a later Windows 11 upgrade.
Options When Your PC Is Out of Support
If your Windows release no longer qualifies for updates, Microsoft lists an upgrade as the remedy for losing Windows Update access. Your next step depends on whether your hardware supports Windows 11 or qualifies for temporary Windows 10 coverage. Here are the routes to consider.
Move to Windows 11 for Free if the PC Qualifies
Your eligible Windows 10 PC can move to Windows 11 at no charge through Windows Update, provided it runs version 2004 or newer. Run PC Health Check to see whether it qualifies and what prevents an upgrade if it doesn’t.
You need a compatible 64-bit processor with at least two cores running at 1 GHz, 4 GB of RAM and 64 GB of storage. Requirements also include UEFI with Secure Boot capability, TPM 2.0, DirectX 12 graphics with a WDDM 2.0 driver and a display larger than 9 inches supporting 720p.
Stay on Windows 10 22H2 With ESU
If your personal PC qualifies, consumer ESU keeps security fixes coming through October 12, 2027. Use the enrollment requirements above, then install the offered updates before your certificate deadline.
Replace the Hardware
If your PC can’t meet Windows 11’s requirements, replacing it is another route to a supported release. Our guide to why you’ll need an AI PC and our look at the Surface Laptop Ultra can help you shortlist a replacement. Treat ESU as temporary coverage while you decide what comes next.
If you manage servers, Server 2016 and Server 2019 need the required patch before May 17, 2027. Older, unsupported releases need an upgrade to a supported Server version.
There’s also a separate certificate issue to keep in mind. The 2026 Secure Boot expiry affects a different part of your PC’s protection.
How This Differs From the 2026 Secure Boot Certificate Expiry
If you’ve already heard about expiring Windows certificates, you may be thinking of Secure Boot. That separate replacement program concerns protection during startup, while the 2027 change controls your connection to Windows Update. Here’s how the two compare.
| Detail | Windows Update certificates in 2027 | Secure Boot certificates in 2026 |
|---|---|---|
| What they protect | Your PC’s trusted connection to Microsoft’s update servers | Trust in software involved in starting your PC |
| Expiry dates | May 17 and June 19, 2027 | June 2026 for KEK and UEFI certificates, October 2026 for Windows Production PCA |
| What stops without replacements | Access to every update category through Windows Update | New early-startup protections, including Boot Manager and Secure Boot database and revocation updates |
| Required fix | Install the relevant monthly patch or upgrade an unsupported Windows release | Replace the 2011 certificates with the 2023 versions, with manufacturer firmware updates needed on some devices |
| Who handles it | Microsoft’s monthly updates, with you or your IT team handling overdue devices | Usually Microsoft-managed updates, with IT teams and device manufacturers involved where needed |
Your PC can still start after the Secure Boot certificates expire, and ordinary Windows updates continue. Keep Secure Boot enabled, since turning it off weakens protection.
Planning Ahead Before May 2027
You still have time to prepare without turning this into a last-minute repair job. Microsoft’s plan comes down to identifying older devices, keeping supported PCs patched and arranging upgrades where support has ended. Start with these checks.
- Identify what you own. Check each PC’s Windows version and compare it with the deadline table, paying particular attention to devices you haven’t updated recently.
- Keep monthly updates current. Install the required security update before your deadline, the same habit that keeps phones safe, as the Samsung October 2026 security update shows. Supported PCs that already have the replacement certificates won’t face an interruption from this change.
- Plan unsupported upgrades. Decide whether your next step is Windows 11, eligible Windows 10 ESU coverage or replacement hardware.
- Don’t wait for Windows 12. Microsoft hasn’t announced it, and the reported 2026 release story was retracted. Windows 11 development continues.
Check your main PC today, then work through the others you use. You’ll know which devices are ready and which still need attention before May or June arrives.
FAQs
No, your PC faces losing Windows Update access, rather than being prevented from starting. Without replacement certificates, affected devices can no longer connect to the service to receive updates.
Yes, you can enroll an eligible personal PC in consumer ESU without paying by syncing your PC preferences through Windows Backup. Redeeming 1,000 Microsoft Rewards points is another option, with coverage ending October 12, 2027.
Yes, you can upgrade an eligible Windows 10 PC to Windows 11 for free through Windows Update. Your device must meet the hardware requirements and run Windows 10 version 2004 or newer.
No certificate-specific action is required if your PC receives updates through WSUS. Microsoft excludes that update delivery method from this change, so the May and June deadlines don’t apply to those connections.
Install the required update manually if your Windows release remains supported, or upgrade if it doesn’t. For supported devices, you can use the Microsoft Update Catalog or have your IT team deploy the patch.
No, you shouldn’t delay required updates or upgrades while waiting for Windows 12. Microsoft hasn’t announced that release, and PCWorld retracted its 2026 launch report after acknowledging an editorial error.
Without replacement certificates, your PC loses access to new protections for the earliest stages of startup. It can still boot and receive regular Windows updates, but some devices need manufacturer firmware updates to complete the certificate replacement.
