Windows Update Cuts Off Out-of-Date PCs in June 2027, Some Business Machines in May

On October 8, 2026, Microsoft announced that the digital certificates Windows uses to confirm it is talking to the real update servers expire on May 17, 2027 and June 19, 2027. A device without the replacement certificates stops receiving every type of update from Windows Update after its deadline. For most machines the fix is simply to be current: Windows 11 version 25H2 needs nothing, version 24H2 needs the September 2025 security update or later, and other supported versions need the July 2026 update or later before June 19, 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2016 and Windows Server 2019 must be ready by May 17, 2027.

What exactly expires?

When your PC asks for updates, it first checks that the server answering belongs to Microsoft and not to someone impersonating it. That check relies on digital certificates, and like any certificate they have an end date. In its official post on the Windows IT Pro Blog, Microsoft says a set of these certificates expires in May and June 2027 and that the replacements already ship inside normal monthly updates. Then it adds:

"If unaddressed, affected devices will stop connecting and receiving all types of updates from Windows Update."

This is different from the Secure Boot certificates that expire on October 19, 2026. Those protect the startup stage, and a PC that misses them still gets regular updates. These cut off updates altogether, including security fixes and the certificate update itself. A machine that misses the date cannot repair itself through Windows Update afterwards; someone has to install the update by hand.

What does each version need?

Here is Microsoft's table as published:

Supported devices that are up to date will notice nothing: the new certificates already arrived with their monthly updates.

Which machines in your company are most likely to be cut off?

• Machines with updates switched off on purpose: the accounting PC where an old update once broke a program, so someone paused updates, or the computer nobody wants to restart. These lose the service first.
• Single-task machines: the cashier terminal, the self-service kiosk, the production-line computer. Microsoft describes LTSC as a deployment option for special-purpose devices that typically do a single important task, and such machines sometimes run it. Windows 10 Enterprise LTSC 2019 is supported until January 2029 according to its lifecycle page, yet it loses updates on May 17, 2027 if it misses the July 2026 update. A machine still under official support can be cut off about 20 months before its support ends.
• Old servers: Windows Server 2016 and 2019 have the May 17, 2027 deadline. Server 2016 also reaches the end of extended support in January 2027 according to its lifecycle page, so its replacement plan should start now, not next summer.
• Windows 10 PCs outside Extended Security Updates: Windows 10 Home and Pro reached end of support on October 14, 2025 according to the official lifecycle page, and since then monthly updates reach only PCs enrolled in the Extended Security Updates program. A PC that is not enrolled never received the July 2026 update, so it lacks the new certificates. The business side of that program is covered in our article on Windows 10 end of support.
• Spare devices in storage: the laptop that has sat in a drawer for months has received nothing. Switch it on and update it before the deadline, or you will be installing the update manually on the day you need it.

Are devices that get updates from an internal server affected?

Microsoft states that this change does not apply to devices receiving updates from Windows Server Update Services (WSUS), an internal update server some companies run. If your IT team operates one, ask how each branch gets its updates. A small office without a dedicated server usually has its PCs talking to Windows Update directly, so the change covers them.

How do you check a PC in two minutes?

1. Find the version: open Settings, then System, then About, and read the version under Windows specifications, such as 24H2 or 25H2. You can also type winver in the Start menu.
2. Find the last update: open Settings, then Windows Update, then Update history, and look at the date of the latest cumulative update installed. July 2026 or later means the PC is ready; on version 24H2, September 2025 or later is enough.
3. If updates are paused: resume them, select Check for updates, then restart.
4. If the PC cannot connect: Microsoft recommends downloading the required update from the Microsoft Update Catalog and installing it directly, or distributing it with the management tools you already use.

An action plan before May 2027

Microsoft's own plan has three steps: identify devices running older or unsupported versions, keep supported devices current with monthly updates, and plan upgrades for unsupported devices before May and June 2027. From experience, we would add:

• List every PC and server: its name, version, last update date and the person responsible for it.
• Set your internal deadline for March 2027, two months before the official one, to leave time for the machine that refuses to update.
• Ask the vendor of your cashier or production-line system in writing: will their machine accept the July 2026 update, and who installs it?
• Put the cost of replacing machines that cannot be upgraded into your 2027 budget, instead of discovering them after updates stop.

The Origami view

The machines that will lose updates in 2027 are not the staff laptops people use every day; those mostly update themselves. The exposed ones are the machines nobody looks at: the cashier PC, the attendance terminal, the old server in the network room, and the computer whose updates were switched off because an old program only works that way. In that last case the problem is not the operating system but the program: a system that stops you updating your PC will later stop you from something more important. If you need someone to inventory your devices, or to move an old system onto a modern one that runs in the browser, get in touch.

Sources

• Microsoft, Windows IT Pro Blog: Prepare for Windows Update certificate rotation in 2027, table and deadlines, October 8, 2026
• Microsoft: Windows message center, October 8, 2026 announcement and the WSUS exception
• Microsoft: Windows Enterprise LTSC overview, special-purpose devices
• Microsoft Lifecycle: Windows 10 Enterprise LTSC 2019, supported until January 2029
• Microsoft Lifecycle: Windows Server 2016, extended support ends January 2027
• Microsoft Lifecycle: Windows 10 Home and Pro, retired October 14, 2025
• MakeUseOf: Windows Update is shutting down in 2027 for millions of PCs, October 9, 2026