Microsoft has announced the cutoff time for Windows updates for older PCs. The company is replacing the certificates that Windows machines use to verify connections to the primary Windows Update servers. Devices that do not have these new certificates installed by the deadline will lose access to the update service.
Microsoft announced this change on October 8 (16 Mehr) via the Windows Message Center. According to the announcement, the current certificates expire on May 17, 2027 (27 Ordibehesht 1406) and June 19, 2027 (29 Khordad 1406). If replacement certificates are not installed on a PC by those dates, the device's access to Windows Update will be completely cut off and it will no longer receive any security patches or feature updates.
The tech giant said most users do not need to take any action. The new certificates are delivered through the regular monthly updates; therefore any PC that installs those updates will already have them. According to the technology website Notebookcheck, at-risk devices are machines that have not received updates for months or that run a version of Windows that is no longer supported.
Requirements by Windows version
The requirements of this change depend on the Windows version:
Windows 11 version 25H2 and newer: no action required.
Windows 11 version 24H2: requires the September 2025 security update (Shahrivar 1404) or a later release. Microsoft is currently automatically upgrading consumer devices on 24H2 to 25H2.
Other supported versions of Windows 11 and Windows 10: must install the July 2026 security update (Tir 1405) or a later release before June 19, 2027 (29 Khordad 1406).
Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016: the deadline for these versions is May 17 (27 Ordibehesht 1406).
Devices running unsupported versions of Windows will lose access to Windows Update entirely, and Microsoft's only recommendation for them is to upgrade to a newer version.
Status of Windows 10 home users
For home users, this primarily concerns Windows 10. A PC that was never enrolled in the Extended Security Updates (ESU) program has received no patches since October 2025 (Mehr 1404); meaning it does not have the July 2026 update either. Such a device will receive updates from Windows Update at most until June 19, 2027 (29 Khordad 1406), after which update delivery will stop.
However, enrollment in the ESU program may still be possible until October 2027 (Mehr 1406). A device that enrolls in the program before June and installs the available updates will be considered supported, and the cumulative update it receives will include the new certificates as well.
Additional notes
How to check: to ensure your PC is up to date, go to Settings > Windows Update and install any pending updates. Running the winver command also lets you see your Windows version.
Security risk: a computer that does not receive security patches remains exposed to known vulnerabilities exploited by malware; therefore ignoring this deadline can pose a real risk.
Organizations: network administrators should check the version and update status of their PC fleet before the deadlines and plan upgrades for older devices if needed.