Microsoft is alerting admins to a certificate expiry that will cut legacy Windows systems off from Windows Update if they aren’t patched in time. Client PCs, workstations, and servers are all in scope. The one carve-out is enterprise network devices serviced through WSUS, which aren’t affected.
Windows Update depends on certificates with a fixed lifespan, and Microsoft has to rotate them periodically to keep monthly updates flowing. Windows 11 25H2 and later ship with the refreshed certificates already in place. Older Windows 11 builds are on the clock, with their certificates expiring next year.
Microsoft has confirmed that the certificates in Windows 11 version 24H2 and Windows Server 2025 expire on June 19, 2027. Devices still on those versions must install the September 2025 security update or a later one to keep access to Windows Update after that date.
Other supported versions of Windows 11, along with Windows Server 2022, face the same expiration date. Those devices need the July 2026 security update or later to keep receiving updates. Supported Windows 10 versions also require the July 2026 update, and their deadline is the same: June 19, 2027.
Devices running the Long-Term Servicing Branch (LTSB) or Long-Term Servicing Channel (LTSC) releases of Windows 10 Enterprise 2019, Windows Server 2019, and Windows Server 2016 face an earlier deadline. They must install the July 2026 security update by May 17, 2027.
Unsupported Windows versions that no longer receive updates will also lose access to Windows Update. Microsoft recommends upgrading these devices.
Microsoft’s warning lands in a community that’s already uneasy about patching. Plenty of Windows users would rather leave a stable machine alone, given the company’s track record of updates that introduce new bugs, even though the standard advice is still to stay current.
Maybe you would like other interesting articles?