Microsoft Will Cut Unpatched PCs Off Windows Update

Microsoft said on October 8, 2026 that Windows Update certificates expire on May 17, 2027 and June 19, 2027, cutting unpatched PCs off the service. Devices that never receive the replacement certificates will stop connecting to Windows Update and will not get security fixes, quality updates, or any other payload that service carries.

Current machines on a supported release already have the new certificates through ordinary monthly patches. The trap is the rest: skipped months, long-life servers, and leftover Windows 10 boxes that still expect the cloud pipe to keep feeding them.

Missed Patches Become a Permanent Cutoff

Andrew Brown of Microsoft put the mechanism in plain language in the company’s Windows Update certificate rotation in 2027 post. Windows Update uses certificate-based trust to confirm a PC is talking to Microsoft’s own update servers. Those certificates carry an end date, so they have to be replaced. Brown’s post and Message Center item MC1491763 both set the dates at May 17, 2027 and June 19, 2027.

If unaddressed, affected devices will stop connecting and receiving all types of updates from Windows Update. However, the key to getting updates from Windows Update beyond 2027 is to keep your devices up to date today.

Andrew Brown, Microsoft, Windows IT Pro Blog

That last line is the second consequence hiding in a routine cert swap. After the old certificates die, a lagging PC cannot pull the new ones from Windows Update, because Windows Update is the thing that just refused the connection. Microsoft’s own recovery path for a supported machine that is behind is no longer the Settings app. It is a manual package from the Update Catalog, or a push from whatever management tool the shop already uses.

Unsupported editions do not get that side door. Brown’s post says those devices lose Windows Update and will not receive any updates as a result, and the only recommendation is an upgrade to a supported client or server release.

Which Windows Versions Need a Patch Before 2027?

Windows 11 version 25H2 and later need no extra work, because the new certificates are already on the image. Version 24H2 and Windows Server 2025 need the September 2025 security update or a later one before June 19, 2027. Every other in-support Windows 11 release, Windows Server 2022, and Windows 10 still listed as in support need the July 2026 security update or later by that same June date, while Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 must finish the same July 2026 bar by May 17, 2027.

MINIMUM UPDATES BY WINDOWS VERSION

The “or later” language is a floor, not a target month. Any newer cumulative security update for the same release also carries the certificates. Windows 11 version 26H2, which reached general availability on September 29, 2026, sits in the 25H2-and-later row. Microsoft’s list of supported versions of Windows client is the document to match against an inventory, because the certificate table only helps if the edition is still in support.

Gabe Frost, who works on product at Microsoft, boiled the same notice down on October 8. He called it an orderly rotation of Windows Update certs and said a machine already at the July patch level is good. The official table is tighter than that shorthand: 24H2 and Server 2025 can stop at the September 2025 security update, which landed months earlier than July 2026.

We’re doing an orderly rotation of WU certs. To get these, patch at least once before next May/June. If you’re already at July patch level, you’re good.

AMAhttps://t.co/IAOvGYIl6B

— Gabe Frost (@bytenerd) October 8, 2026

Three Support End Dates Land on October 13

The certificate notice went out four days before a cluster of servicing dates that shrink the set of machines still able to pick up those packages through Windows Update. Home and Pro editions of Windows 11 version 24H2 reach end of updates on October 13, 2026. Windows 10 Enterprise LTSB 2016 reaches end of updates the same day. Microsoft’s lifecycle FAQ also ends year 1 of commercial Windows 10 Extended Security Updates on October 13, 2026.

THE DATES AROUND THE CERTIFICATE SWAP

1. October 8, 2026: Microsoft publishes the Windows Update certificate notice and MC1491763.
2. October 13, 2026: Windows 11 24H2 Home and Pro, and Windows 10 Enterprise LTSB 2016, reach end of updates; commercial ESU year 1 ends.
3. May 17, 2027: Certificates expire for Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016, 33 days before the June date.
4. June 19, 2027: Remaining Windows Update certificates expire for the other listed releases.
5. October 12, 2027: Consumer Windows 10 Extended Security Updates end.

Microsoft says unmanaged Home and Pro PCs still on 24H2 will get Windows 11 version 25H2 automatically, which moves those machines into the no-action row. The 24H2 line in the certificate table is for fleets held on 24H2, including Enterprise and Education editions that stay in support until October 12, 2027. Windows 11 version 23H2 Enterprise and Education reach end of updates on November 10, 2026, after which that release leaves the “in support” row.

Brown told admins that if they still need to act on older device populations, there is still time. The May 17, 2027 group is the one with the least of it. Server 2016, Server 2019, and Windows 10 Enterprise 2019 LTSC often sit at the back of patch queues, and they are the SKUs Microsoft put on the earlier clock.

The WSUS Exemption for Local Update Servers

Brown’s post and MC1491763 both say the change does not apply to devices receiving updates from Windows Server Update Services. Those PCs talk to a local WSUS host, not to Microsoft’s internet endpoints, so the cloud certificates are not the trust path that feeds them patches.

That split decides who actually feels a June 2027 outage. Home PCs, small shops, and remote laptops that check in directly with Windows Update are in scope. A corporate desktop that only ever sees WSUS is not, at least as a client. Mixed fleets are the messy case: a laptop can be a WSUS client on the office network and a Windows Update client in a hotel, and only the second path has a certificate deadline.

WHAT WE KNOW

• WSUS clients: Microsoft says the 2027 rotation does not apply to devices that get updates from WSUS.
• Supported but behind: After expiry, those machines can still be fixed with a package from the Update Catalog or a management tool.
• Unsupported editions: Microsoft’s only published path is an upgrade; the notice does not offer a catalog workaround for those SKUs.

WHAT IS UNCONFIRMED

• WSUS upstream sync: The notice is silent on whether a WSUS server’s own catalog sync with Microsoft uses the same expiring certificates.
• Install media: Microsoft has not said whether a Server 2019 or Server 2022 ISO dated after the expiry already contains the new certificates.
• KB map: The post lists months, not KB numbers or certificate names, so readiness is inferred from the installed cumulative update.

The ISO question is the one worth planning around even without an answer. A new virtual machine built from old media after May 2027 could boot cleanly and still fail its first trip to Windows Update, unless the image is slipstreamed or the first patch arrives from Catalog or WSUS.

Windows 10 Holdouts Still Need the July 2026 Update

Windows 10 left mainstream support on October 14, 2025. It is still a large share of what the web sees. StatCounter’s September 2026 desktop Windows figures put Windows 11 at 71.5% and Windows 10 at 27.77% of desktop Windows pageviews, with Windows 7 at 0.55%, Windows 8.1 at 0.09%, Windows XP at 0.05%, and Windows 8 at 0.02%.

DESKTOP WINDOWS SHARE, SEPTEMBER 2026

• Windows 11: 71.5% of desktop Windows pageviews in StatCounter’s worldwide sample.
• Windows 10: 27.77%, a year after mainstream support ended.
• Windows 7: 0.55%, with 8.1, XP, and 8 together under 0.2%.
• The upgrade row: Anything outside the in-support list, including those older versions, must move before the certificates die.

Microsoft’s certificate table still includes “Windows 10 versions in support” and tells those devices to install the July 2026 security update or later before June 19, 2027. For a home PC that is how Extended Security Updates keep arriving. Microsoft’s consumer ESU page says those critical and important security updates are delivered through Windows Update, and consumer ESU coverage through October 12, 2027 stays open for enrollment until that same date.

CONSUMER ESU TERMS THAT STILL DEPEND ON WINDOWS UPDATE

• Who qualifies: Windows 10 version 22H2 Home, Professional, Pro Education, or Workstations, with the latest update and the ESU licensing package KB5126256.
• How to pay: Sync PC Settings at no extra cost, redeem 1,000 Microsoft Rewards points, or buy a one-time $30 USD license (plus tax), good for up to 10 devices.
• How fixes arrive: After enrollment, critical and important security updates come through Windows Update, which is the path the 2027 certificates protect.

A Windows 10 PC that enrolled in ESU and then stopped patching before July 2026 is the ugly overlap. The program can still run until October 12, 2027, but only if the device can still talk to Windows Update in June. Once the certificates expire, that talk ends unless someone installs the required update by hand. Kiosks, lab boxes, and PCs that never signed in with a Microsoft account are the population that silently misses both the July 2026 bar and the ESU prompt in Settings.

Secure Boot’s Separate Firmware Certificate Clock

Admins have already spent 2026 replacing Secure Boot certificates issued in 2011. Microsoft Corporation KEK CA 2011 expired on June 24, 2026. Microsoft UEFI CA 2011 expired on June 27, 2026. Microsoft Windows Production PCA 2011 expires on October 19, 2026. Those live in firmware databases and sign boot loaders, not the TLS session that Windows Update uses.

The failure modes do not match. A PC that missed the Secure Boot swap can still boot and can still take ordinary Windows updates, even if future boot-manager protections stall. The 2027 Windows Update rotation is the reverse: the machine boots, then it cannot reach the service that would have patched it. Treating the two notices as one project will hide the machines that are current on firmware and months behind on cumulative updates.

Brown’s 2027 post also never asks for a firmware flash. The new Windows Update certificates travel inside the monthly security updates already on the calendar. That is why 25H2 and later are done, and why a 24H2 box that installed September 2025 or newer is done too.

What Happens If a PC Misses the 2027 Dates?

A supported PC that is behind loses Windows Update after its deadline, then can be recovered with the matching security update installed from the Catalog or a management tool. An unsupported PC loses Windows Update with no Microsoft recovery path except an upgrade. Home users should confirm the version, install pending updates before the date that applies, and treat any block on Windows Update as a problem to clear now, not in 2027.

CHECKS THAT STILL WORK BEFORE THE CERTIFICATES DIE

1. Read the version: Settings, then System, then About, and match the edition against Microsoft’s table.
2. Install what is pending: On a supported release, take every security update already offered, which for most in-support SKUs means July 2026 or later is already in the past.
3. Enroll leftover Windows 10: If the PC is 22H2 and still in use, finish ESU enrollment so later 2027 fixes have a license to land.
4. Keep a Catalog path: If Windows Update is already failing, download required updates from the catalog rather than waiting for Settings to heal itself.
5. Plan the upgrades: Anything in the “other Windows versions” row needs a supported client or server release before May 17, 2027 or June 19, 2027, depending on the SKU.

IT teams have the same three steps Microsoft wrote down: find older and unsupported devices, keep supported ones on monthly patches, and write an upgrade plan before those 2027 dates. The extra work is mapping who actually talks to the cloud. WSUS clients can wait for separate guidance on the upstream host. Direct-to-Microsoft devices cannot.

The certificates will expire on the dates Microsoft printed. A fully patched 25H2 or 26H2 PC will not notice. A Windows 10 box that still wants ESU fixes next summer will notice immediately if July 2026 never landed, because the service that was supposed to carry the rest of the program will have stopped answering.