If your business has computers running older versions of Windows, Microsoft just put a firm expiration date on their ability to receive security updates. And it is closer than most business owners realize.
Microsoft announced this week that devices running unsupported or outdated versions of Windows will stop receiving security updates entirely after a scheduled certificate rotation happening in May and June of 2027. Once those certificates expire, affected devices will lose access to Windows Update services permanently — meaning no more security patches, no more protection against newly discovered vulnerabilities, and no path back in without upgrading the operating system.
What Is Actually Happening and Why
Windows Update relies on digital certificates to verify that updates are legitimate and coming from Microsoft. Those certificates have expiration dates, and Microsoft rotates them periodically as a standard security practice. The next rotation is scheduled for May 17, 2027 and June 19, 2027.
Devices running a supported, up-to-date version of Windows have already received the replacement certificates automatically. Devices running older or unsupported versions have not and will not. When the old certificates expire, those devices will simply stop being able to connect to Windows Update at all.
In plain terms: if a computer in your business is running an unsupported version of Windows and nothing is done before mid-2027, that machine becomes permanently unpatched. Every vulnerability discovered after that date goes unaddressed, forever, until the device is upgraded or replaced.
Which Versions Are Affected
Microsoft published specific guidance based on Windows version. Here is what matters for most small businesses.
Windows 11 version 25H2 and later requires no action. Windows 11 version 24H2 and Windows Server 2025 need the September 2025 security update or later installed before June 19, 2027. Other supported versions of Windows 11 and Windows 10 need the July 2026 security update or later installed before June 19, 2027. Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016 need the July 2026 security update or later installed before May 17, 2027.
Any other Windows version — including Windows 7, Windows 8, and older builds — needs to be upgraded to a supported version before the deadline. There is no patch available for these versions. The only path forward is upgrading the operating system or replacing the hardware.
It is also worth noting that Windows 10 mainstream support ended in October 2025. Businesses still running Windows 10 without an Extended Security Update enrollment are already operating on borrowed time, and that situation becomes significantly more urgent after the 2027 certificate rotation.
Why This Matters More Than a Routine Reminder
Businesses often keep older computers running longer than they should because they still function for day-to-day tasks. A machine that runs email and a few applications feels fine, so replacing or upgrading it gets pushed back year after year.
The certificate rotation changes that calculus. This is not a situation where an older machine simply misses a few minor updates. After mid-2027, an unsupported Windows device receives zero security patches going forward. Every new vulnerability that researchers discover, every zero-day that gets exploited in the wild, every attack technique that emerges — none of it gets addressed on that machine. It becomes a permanently exposed endpoint sitting inside your business network.
For businesses in the South Bay and East Bay, where INFORTECH serves clients across a wide range of industries, unpatched endpoints are one of the most consistent risk factors we see. An older machine that goes unpatched is not just a problem for that device. It is a potential entry point into everything else on your network.
What Your Business Should Do Before Mid-2027
Start by finding out exactly what Windows versions are running across your devices. If your business does not have a current inventory of its computers and their operating systems, now is the time to build one. You cannot plan an upgrade if you do not know what you are working with.
For devices running supported versions of Windows, make sure monthly security updates are being applied consistently. The replacement certificates have already been delivered through recent updates, so staying current is all that is required.
For devices running unsupported versions, build a realistic upgrade or replacement plan well before the deadline. Mid-2027 sounds distant, but hardware procurement, data migration, and software compatibility testing take time. Businesses that start planning now will execute smoothly. Businesses that wait until early 2027 will be scrambling under deadline pressure.
If you are not sure where your devices stand, that is exactly what INFORTECH can help you figure out. An audit of your current device inventory and Windows versions is the logical first step, and the time to do it is now rather than six months before the deadline.
The Bottom Line
Microsoft has set a clear, non-negotiable deadline. Devices running unsupported Windows versions will stop receiving security updates permanently after May and June 2027. The businesses most at risk are the ones with older machines that have been kept running because they still work, not because they are secure. This week’s announcement is the prompt to take inventory, make a plan, and act before the window closes.