Microsoft will rotate the certificates that verify its Windows Update infrastructure in 2027. Devices whose updates stopped at some point will permanently lose access to Windows Update.
Microsoft has announced that the certificates used to verify its Windows Update infrastructure will be rotated in 2027. According to the notice published on the company's Windows IT Pro blog, the current certificates expire on 17 May 2027 or 19 June 2027, depending on the Windows version. Devices that have not received the replacement certificates by those dates will lose access to Windows Update services and will stop receiving any updates at all, security fixes included.
Certificate rotation is routine security hygiene. The problem is not the rotation itself but how the replacements travel: they ship inside the ordinary monthly updates. For a machine that takes its updates regularly, there is nothing to do. For a machine whose updates stopped at some point, the logic turns circular: it cannot receive the new certificate because it is not being updated, and once the old certificate expires it will never be updated again.
Which versions need which update
The thresholds, as reported by BleepingComputer from Microsoft's notice:
- Windows 11 25H2 and later: no action required.
- Windows 11 24H2 and Windows Server 2025: the September 2025 security update or later, installed before 19 June 2027.
- Other supported Windows 11 builds, Windows Server 2022 and Windows 10: the July 2026 security update or later, before 19 June 2027.
- Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016: the July 2026 security update or later, before 17 May 2027.
- Anything older: needs an upgrade to a supported version.
Help Net Security notes that supported systems which miss the deadline can still recover: installing the required update manually from the Microsoft Update Catalog, or pushing it through management tooling, restores access. Devices that receive their updates through WSUS are outside the scope of this change entirely.
What it means for small and mid-sized businesses
This is not an emergency vulnerability. It is a planning item announced seven months ahead, and that is precisely where its value lies. Most companies have a handful of machines whose updates stopped months ago, and they stayed that way because nobody noticed. The PC wired to the barcode terminal in the warehouse, the operator station on the production line, the accounting machine everyone has been told not to touch, a backup server pushed into a corner.
Until now those devices were merely out of date. After 2027 they move into a different category: permanently unable to update. Because Windows Server 2016 and 2019 are on the list, this is not a desktop-only concern either. Windows Server 2016 support ends on 12 January 2027 in any case, so two separate clocks run through the same window.
What we recommend at Kamer Bilişim
- Inventory first, patch second. List which machine runs which Windows build and when it last took an update. Any patching effort started without that list mostly spends itself updating machines that were already current.
- Aim for the July 2026 threshold. That is the minimum level most versions need. Lifting the whole fleet above it clears both 2027 dates in a single pass, and there is no reason to wait: done early, it fits inside a normal maintenance window.
- Give Server 2016 and 2019 their own plan. These face the earlier date, 17 May 2027, and for 2016 the end-of-support clock runs alongside it. Server upgrades need application compatibility testing, so that plan has to start months in advance.
If you want a device inventory, an assessment of your current patch level, or a Windows Server upgrade plan for your office on Istanbul's Anatolian side, you can reach us through our contact page. For clients on a corporate maintenance agreement, inventory and patch tracking are already in place.
Source: Microsoft Windows IT Pro Blog, BleepingComputer, Help Net Security
Source: Microsoft Windows IT Pro Blog