Prepare for Windows Update certificate rotation in 2027

What changed

Windows Update trust certificates expire on May 17 and June 19, 2027. Supported devices that contain the replacement certificates continue updating, while older or insufficiently patched devices require an update or operating-system upgrade before the applicable deadline.

Why it matters

A device without the replacement certificates will lose access to every update type delivered by Windows Update after the applicable expiration date; Microsoft states that devices receiving updates through WSUS are not affected.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Inventory Windows versions and patch levels, separating Windows 11 25H2 or later, Windows 11 24H2 and Windows Server 2025, other supported clients and servers, and unsupported systems
• Install the September 2025 security update or later on Windows 11 24H2 and Windows Server 2025, and the July 2026 security update or later on the other affected supported versions before Microsoft's May or June 2027 deadline
• Plan upgrades for unsupported Windows versions and validate direct Windows Update connectivity on representative devices; exclude WSUS-serviced devices from this specific certificate-rotation scope