Microsoft has warned users who have disabled Windows Update or neglected system maintenance that they may be blocked from downloading future patches and security updates through official channels starting in 2027.
The coming disruption is caused by the expiration of digital certificates used to authenticate Windows Update servers, which are set to lapse on May 17 and June 19, 2027. Devices that fail to install updated certificates prior to these cut-off dates will lose the ability to establish secure connections with Microsoft’s update infrastructure.
Digital certificates function as virtual identity cards, allowing Windows to verify that it is connecting to genuine Microsoft servers rather than fraudulent entities. Microsoft said that while expired certificates will not prevent PCs from booting or affect running software, affected devices will be unable to pull automated updates.
Users of Windows 11 who perform regular maintenance will experience no issues, as Microsoft has already begun distributing updated certificates. The required credentials are standard in Windows 11 version 25H2 and later, while version 24H2 requires patches issued from September 2025 onward. Meanwhile, supported editions of Windows 10 and Windows Server require updates released from July 2026.
Systems facing the highest risk include legacy platforms and devices where update features have been permanently switched off. Devices running Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 face an earlier deadline of May 17, 2027-roughly a month ahead of other editions.
Users who miss the deadline will not need to reinstall their operating system. Required patches can be manually retrieved from the Microsoft Update Catalogue to install the new certificates and restore automated update services, provided the OS edition remains within its official support lifecycle.
Microsoft said these expiring digital certificates are separate from the Secure Boot certificates that drew media attention previously. Secure Boot handles system validation during startup, whereas the certificates in question strictly govern connections to Windows Update servers.
To ensure uninterrupted service, users simply need to navigate to Settings > Windows Update > Check for updates and complete all pending installations. The issue primarily impacts users who deliberately block updates and organisations running unpatched legacy systems.
For Windows 10 users, Microsoft advised checking whether devices remain within active support periods or are covered under Extended Security Updates (ESU), stressing that installing new digital certificates will not extend support for end-of-life systems.