Microsoft to halt security updates for outdated Windows devices after certificate rotation
Microsoft warns that unsupported Windows versions will cease receiving security patches following next year's certificate rotation.
Key points
- Microsoft states that devices running unsupported Windows versions will stop receiving security updates.
- The cutoff is tied to next year's Windows Update certificate rotation.
- This action affects devices that are already outside of Microsoft's support lifecycle.
Microsoft has announced that devices running unsupported versions of Windows will no longer receive security updates. The company confirmed that this cessation of support will occur after the Windows Update certificate rotation scheduled for next year.
According to BleepingComputer, Microsoft’s statement clarifies that the update infrastructure will no longer deliver patches to these older systems once the certificate change takes effect. This move reinforces the boundary between supported and unsupported software, ensuring that the update mechanism only services devices that remain within the vendor's active support window. The certificate rotation serves as a technical enforcement mechanism for existing support policies.
Context and background
The Windows Update service relies on digital certificates to verify the authenticity and integrity of software updates. Periodic certificate rotations are a standard security practice to prevent long-term credential compromise. By aligning the end of update delivery for unsupported versions with this rotation, Microsoft simplifies the technical process of discontinuing support.
Previously, some unsupported devices might have continued to receive security updates for a limited period after their official end-of-support date, depending on specific program terms or grace periods. This upcoming change removes that ambiguity for versions that are already unsupported. The announcement does not indicate a change to the support lifecycle dates for currently supported versions of Windows, but rather confirms the technical endpoint for those already outside of support.
Who is affected
This change impacts users and organizations that continue to operate devices on Windows versions that Microsoft has already declared unsupported. These are systems that have reached their end-of-life or end-of-support date prior to the upcoming certificate rotation.
Organizations that have delayed upgrading their infrastructure to supported versions of Windows will find their devices unable to download new security patches after the rotation. This includes legacy systems that may have been grandfathered into receiving updates under previous arrangements or those that were simply overlooked during upgrade cycles. The primary risk is exposure to newly discovered vulnerabilities for which no patches will be distributed via Windows Update.
What should you do?
Security professionals should audit their environments to identify any devices running unsupported versions of Windows. It is critical to determine if these systems are still in use and whether they are connected to networks that require security updates.
If unsupported devices are necessary for legacy operations, organizations should consider isolating them from the main network to reduce exposure to threats. Alternatively, plans should be made to upgrade these devices to supported versions of Windows before the certificate rotation takes place. Monitoring vendor communications for the exact date of the certificate rotation is also advisable to prepare for the cutoff.
What to do and how to stay safe: Microsoft
- Inventory all devices to identify those running unsupported versions of Windows.
- Isolate unsupported systems from critical network segments if they cannot be upgraded immediately.
- Plan upgrades to supported Windows versions prior to the next certificate rotation.
- Monitor official Microsoft channels for the specific date of the certificate rotation.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When will unsupported Windows devices stop receiving updates?
They will stop receiving updates after next year's Windows Update certificate rotation.
Does this affect currently supported versions of Windows?
No, this announcement specifically concerns devices running unsupported versions of Windows.
Why is Microsoft making this change?
The change is tied to the technical process of rotating Windows Update certificates.
