Overview
- Microsoft published guidance in October 2026 telling IT teams that Windows Update signing certificates expire on 17 May 2027 for some builds and on 19 June 2027 for others.
- Many supported Windows releases already received the replacement certificates with the July 2026 security updates so most up-to-date machines need no action.
- Certain versions have specific requirements: Windows Server 2016, Server 2019 and Windows 10 Enterprise 2019 LTSC must have the July 2026 update by 17 May 2027, while other supported Windows 10/11 and Server builds generally must have July 2026 updates by 19 June 2027; Windows 11 24H2 and Windows Server 2025 instead need the September 2025 security update and Windows 11 25H2 or newer already include the new certificates.
- Devices that do not receive the replacement certificates will stop connecting to Windows Update after the expiry dates but machines using WSUS will be unaffected and admins can also install updates manually from the Microsoft Update Catalog or push them with management tools.
- Administrators should inventory networks, apply the specified security updates or plan upgrades for unsupported systems before the deadlines to avoid missed security patches and increased exposure for users and servers.