Microsoft has warned that Windows devices running unsupported versions, or supported versions that are missing recent patches, will lose access to Windows Update when a set of Windows Update certificates expires on May 17, 2027 and June 19, 2027.

The notice was published in the Windows release health message center on Thursday, with a matching entry in the Microsoft 365 Message Center (MC1491763).

Affected devices "will lose access to Windows Update services and won't receive any updates as a result," according to Microsoft. Systems on a supported Windows version that are fully updated already have the replacement certificates and need no further action.

Microsoft describes the expiration as standard security practice. Certificates used by Windows Update carry an expiration date and eventually have to be rotated, which means replaced with new certificates. The company says the replacement certificates have already been delivered to supported systems through regular updates.

The required action depends on the Windows version, according to Microsoft's guidance:

• Windows 11, version 25H2 and later: no action is required.
• Windows 11, version 24H2 and Windows Server 2025: install the September 2025 security update or later before June 19, 2027.
• Other supported versions of Windows 11, Windows Server 2022, and Windows 10: install the July 2026 security update or later before June 19, 2027.
• Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: install the July 2026 security update or later before May 17, 2027.
• All other Windows versions: upgrade to a supported version of Windows client or Windows Server.

The earlier May deadline applies only to the older long-term servicing release and the 2016 and 2019 server editions. Administrators responsible for those systems have about a month less than everyone else.

Windows 11 version 26H2, which Microsoft shipped as a small enablement package last month, falls under the "25H2 and later" group and needs no action.

Microsoft asks IT administrators to identify all devices running older or unsupported Windows versions, deploy monthly updates to every supported device, and create an upgrade plan for unsupported hardware before the 2027 dates. The same logic applies to home PCs.

1. Check which Windows version and edition the PC is running.
2. Compare the result with Microsoft's list and confirm that the required security update is installed (September 2025 or later for version 24H2, July 2026 or later for other supported versions).
3. Install any pending updates through Windows Update before the deadline that applies to the device.
4. Plan an upgrade to a supported Windows client or Windows Server release for any device on an unsupported version.

"And if you do need to act on older device populations, there's still time!" the company wrote in the notice.

The warning does not apply to devices that receive updates through Windows Server Update Services (WSUS), which downloads updates and distributes them across enterprise networks. Microsoft's notice does not describe a separate certificate timeline for WSUS-managed devices.