Windows Update: Outdated PCs will stop getting updates in June 2027

Microsoft is replacing the certificates that Windows PCs use to verify they are talking to genuine Windows Update servers. The company announced the change on October 8 in the Windows message center. The current certificates expire on May 17 and June 19, 2027. A PC that does not have the replacement certificates by then will lose access to Windows Update completely and receive no security patches or feature updates at all.

Most people do not need to do anything. The new certificates ship with the regular monthly updates, so any PC that installs them already has what it needs. The devices at risk are those that have not been updated in months and those running a Windows version that is no longer supported.

Which update each Windows version needs

According to the Windows IT Pro Blog, the requirement depends on the version. Windows 11 25H2 and later need no action. Windows 11 24H2 needs the September 2025 security update or any later one, and Microsoft is already moving consumer 24H2 PCs to 25H2 automatically. All other supported releases of Windows 11 and Windows 10 need the July 2026 security update or a newer one before June 19, 2027. For Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016, the deadline is May 17. Devices on unsupported Windows versions will lose Windows Update access entirely, and Microsoft's only advice for them is to upgrade.

Windows 10 without ESU is the real problem

For home users, this mainly affects Windows 10. A PC that was never enrolled in Extended Security Updates (ESU) has not received a patch since October 2025, which means it never got the July 2026 update. By June 19, 2027 at the latest, Windows Update will stop delivering anything to it. You can still enroll in ESU until October 2027. A PC that joins before June and installs the updates it is offered counts as supported, and the cumulative update brings the new certificates with it. Our guide to Windows 10 support explains the requirements.

How to check your PC

Type winver into the taskbar search to see which Windows version is installed. The update history lists the most recent update. On Windows 11, it is under Settings and Windows Update, while Windows 10 keeps it under Update and Security. A cumulative update from July 2026 or later covers every supported version. If it is missing, a manual check for updates in Windows Update usually fixes it. If Windows Update does not offer the package, Microsoft points to the Microsoft Update Catalog, where it can be downloaded manually. Business PCs that get their updates through WSUS are not affected by the change.