Windows PCs Could Lose Security Updates in 2027 Unless Microsoft Certificates Are Renewed

Microsoft is urging Windows users and businesses to keep their computers updated ahead of a certificate expiry deadline in 2027 that could prevent some devices from receiving essential security fixes. The change affects digital certificates used to verify Windows Update servers, with older or unpatched systems potentially losing access to Microsoft’s update service.

The certificates are scheduled to expire on 17 May or 19 June 2027, depending on the Windows version installed. Microsoft is distributing replacement certificates through a process known as certificate rotation to ensure devices can continue receiving updates securely.

For New Zealand households, businesses and organisations relying on Windows computers, the approaching deadline highlights the importance of maintaining supported operating systems and installing regular security patches.

Microsoft Warns Windows Users to Prepare for 2027 Certificate Expiry

Digital certificates play an important role in securing communications between Windows devices and Microsoft’s update infrastructure. They help establish trust when computers connect to Windows Update to download software improvements and security patches.

When the existing certificates expire in 2027, devices that have not received the replacements could lose access to Windows Update.

Microsoft has begun distributing updated certificates through regular Windows security updates, allowing most supported computers to complete the transition automatically.

“However, the key to getting updates from Windows Update beyond 2027 is to keep your devices up to date today,” Microsoft’s Andrew Brown said.

The company is encouraging users and IT administrators to check their systems well before the expiry dates rather than waiting until access to updates is disrupted.

Which Windows Versions Need Updating Before 2027?

Most computers running supported versions of Windows should receive the replacement certificates automatically through Microsoft’s monthly security updates.

However, the required update depends on the operating system version, and some devices managed by businesses or organisations may require administrator intervention.

Windows 11 Update Requirements

Microsoft has outlined different requirements for supported Windows versions.

• Windows 11 version 25H2 and later: No additional action is required.

• Windows 11 version 24H2: Devices must have the September 2025 security update or a later release installed.

• Other supported Windows versions: Several require the July 2026 security update or a later release.

Users running supported Windows systems that have fallen behind on updates must install the relevant security patches to receive the replacement certificates.

Microsoft also advises users operating unsupported Windows versions to upgrade to a supported release.

For New Zealand businesses managing large numbers of computers, checking update compliance across their devices could help prevent disruption when the certificates expire.

What Happens if Windows Update Certificates Expire?

Computers that have not received the replacement certificates before the 2027 deadline could lose access to Windows Update.

This would prevent affected devices from receiving security fixes and other updates distributed through the service until the required certificates are installed.

Although the expiry does not necessarily mean that Windows itself will stop working, the interruption could leave computers without newly released security patches.

Devices Can Recover Access After the Deadline

Microsoft has confirmed that supported Windows systems can regain access to Windows Update even after the certificate expiry dates.

Users and administrators will need to install the appropriate security update containing the replacement certificates.

IT administrators can obtain the required update from the Microsoft Update Catalog or distribute it using their organisation’s existing device management tools.

This recovery option means missing the deadline does not permanently prevent supported computers from receiving future Windows updates.

However, completing the certificate rotation in advance can reduce the risk of interruptions to routine security maintenance.

Windows Server Update Services Devices Are Excluded

Microsoft has clarified that devices receiving updates through Windows Server Update Services (WSUS) are excluded from this particular certificate rotation change.

WSUS allows organisations to manage and distribute Microsoft updates across computers connected to their internal networks.

The exclusion is relevant to businesses and other organisations using centralised update management systems.

Nevertheless, administrators remain responsible for ensuring their Windows environments receive applicable security updates and continue operating on supported software versions.

Why Regular Windows Security Updates Matter

The certificate rotation is part of Microsoft’s ongoing maintenance of the security infrastructure supporting Windows Update.

For New Zealand users, the main precaution is straightforward: keep supported Windows devices updated and ensure required security patches are installed before May and June 2027.

Businesses managing older computers or systems that do not receive updates automatically may need additional preparation.

By installing the necessary updates ahead of the deadline, users and organisations can maintain access to Windows Update and reduce the likelihood of missing important security fixes when the existing certificates expire.