Microsoft is changing Windows on almost all PCs. Secure Boot is a critical component in keeping users safe. It relies on certificates installed on PCs — but those certificates now expire. New ones will install automatically onto most PCs— but not for hundreds of millions of users, who will be at immediate risk.

Microsoft warns that “it’s important to note that devices running unsupported versions do not receive Windows updates and will not receive the new certificates.” That means all Windows 10 users, other than those enrolled for extended support updates. The ESU program is currently live but only until October.

Microsoft says Secure Boot “helps to prevent malicious software from loading when a Windows PC starts up.” Those certificates, “originally issued in 2011," start to expire in late June. Last month’s Windows security updates installed new certificates and a status update to confirm PCs are secure.

“The slow decline of outdated Windows versions continues as Microsoft confronts expiring Secure Boot certificates for the first time ever,” says Windows Central . When this launched, “the potential issues surrounding the expiry of associated certificates seemed like a far-off problem. Well, the future is here 15 years later, and there are countless Secure Boot certificates set to expire in June 2026.”

If you’re running Windows 10, this is yet another reason to act. Ideally, you should upgrade all eligible PCs to Windows 11. If the PC cannot be upgraded, it needs to be installed in the ESU. You can find details here . The Windows-maker says this “helps reduce the risk of malware and cybersecurity attacks by providing access to critical and important security updates,” but only security updates, nothing else.

There is now plenty of advice for Windows 11 users on checking their Secure Boot status, a process that changes again this month, with stark warnings on PCs where additional action is needed. Windows 10 users outside the ESU will see no such warnings. The timing coming just months after the OS expired is an additional worry for users, and should be an additional impetus for action.

As for the ESU, Microsoft confirms it “you can enrol in ESU any time until the programme ends on 13 October, 2026, however devices will be more vulnerable and susceptible to viruses and malware before enrolment.”