KBY Technologies Logo

Admin deadlines

What Microsoft and Apple are retiring, changing or enforcing, and when

One list for endpoint and identity admins: Intune, Entra ID, Exchange Online, Windows, PowerShell and Apple device management. Each entry says who is affected and what to do, and quotes the vendor line that gives the date.

Next 90 days
2
Upcoming in total
4
Passed in the last 6 months
4

Each date is quoted from the vendor’s own page. Dates move; check the source before you act. Where a vendor gives only a month or a rough period, we show that, not a made-up day. Checked 9 Nov 2026.

Clear

Upcoming (filtered)

January 2027

In 53 daysMicrosoftEnforcementVendor gives the month only

ReFS volumes on removable media: enforcement phase

WindowsWindows Server

Who is affected
Devices that use ReFS on externally attached or removable storage. The October 2026 update started the audit phase; the January 2027 update can block affected volumes.
What to do
  1. Review the audit events added by the October 2026 update to find external ReFS volumes.
  2. Reformat or move data off unsupported external ReFS configurations before January 2027.
Source
Hardening changes for ReFS volumes on removable media“January 2027 Windows security update (Enforcement phase)”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

In 64 daysMicrosoftEnd of support

Windows Server 2016 (and WSUS on it) reaches end of updates

Windows Server

Who is affected
All editions of Windows Server 2016, including servers that host WSUS, Configuration Manager site roles, certificate services or other endpoint management infrastructure.
What to do
  1. List Windows Server 2016 machines that support endpoint management (WSUS, distribution points, NDES, connectors).
  2. Rebuild or upgrade them to Windows Server 2025.
  3. Buy ESU for Standard and Datacenter servers that cannot move in time.
Source
90-Day Reminder: Windows Server 2016 will reach end of updates on January 12, 2027“On January 12, 2027, Windows Server 2016 will reach end of updates.”
Windows message center (Windows release health, Microsoft Learn)
Products reaching End of Support“Windows Server 2016 | Windows Server Update Services for Windows Server 2016 | January 12, 2027”
Ending Support in 2027 (Microsoft Lifecycle)

Checked 9 Nov 2026 Link to this deadline

May 2027

In 189 daysMicrosoftEnforcement

Windows Update certificate rotation: Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and 2016

WindowsWindows Server

Who is affected
Windows 10 Enterprise 2019 LTSC, Windows Server 2019 and Windows Server 2016 devices that get updates directly from Windows Update. Devices updated through WSUS are not affected by this change.
What to do
  1. Install the July 2026 security update or later on these devices before May 17, 2027.
  2. Find devices that have stopped patching: without the replacement certificates they lose access to Windows Update.
Source
Prepare for Windows Update certificate rotation in 2027“Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Install the July 2026 security update or later before May 17, 2027.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

June 2027

In 222 daysMicrosoftEnforcement

Windows Update certificate rotation: Windows 11, Windows Server 2022/2025 and other in-support Windows 10

WindowsWindows Server

Who is affected
In-support Windows 11, Windows Server 2022 and 2025, and in-support Windows 10 devices that are behind on monthly updates. Windows 11, version 25H2 and later need no action.
What to do
  1. Windows 11, version 24H2 and Windows Server 2025: install the September 2025 security update or later.
  2. Other in-support Windows 11, Windows Server 2022 and Windows 10: install the July 2026 security update or later.
  3. Upgrade any out-of-support Windows version, which will lose access to Windows Update.
Source
Prepare for Windows Update certificate rotation in 2027“Certificates used to establish trusted connections to Windows Update will expire on May 17, 2027 and June 19, 2027. Devices must contain the replacement certificates to continue receiving updates after the applicable expiration date.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Put these dates in your calendar

The calendar feed uses the filter you have selected and refreshes daily in Outlook, Apple Calendar and Google Calendar. Each event carries the actions and the source link.

Download .ics JSON

webcal://www.kbytechnologies.com/deadlines/calendar.ics?products=windows-server

Embed the next deadlines on your intranet

Paste this into a SharePoint embed web part or any page that allows iframes. Add &limit=10 to the URL for more rows.

<iframe src="https://www.kbytechnologies.com/deadlines/embed?products=windows-server" title="Upcoming Microsoft and Apple admin deadlines" width="400" height="460" loading="lazy" style="width:100%;max-width:480px;border:1px solid #e2e8f0;border-radius:12px"></iframe>

Recently passed

Dates from the last 6 months. If one of these still applies to you, you are already past the vendor’s date.

21 days agoMicrosoftEnd of support

Secure Boot: Microsoft Windows Production PCA 2011 expires

WindowsWindows Server

Who is affected
Windows devices whose boot manager still relies on the 2011 Windows Production PCA. The replacement is Windows UEFI CA 2023, which signs the Windows boot loader.
What to do
  1. Confirm devices report the Windows UEFI CA 2023 certificate in the Secure Boot database.
  2. Expect one extra restart on some devices when the Secure Boot certificate update applies.
  3. Refresh boot media, PXE images and VM templates so they boot with the new certificate chain.
Source
Secure Boot certificates expiring in 2026“Microsoft Windows Production PCA 2011 | October 19, 2026 | Windows UEFI CA 2023 | Stored in DB | Used for signing the Windows boot loader.”
Manage Secure Boot certificate updates (Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Passed (October 2026)MicrosoftEnforcementVendor gives the month only

NTLMv1-derived credentials for single sign-on restricted by default

WindowsWindows Server

Who is affected
Windows 11 (24H2, 25H2, 26H2) and Windows Server 2025 devices with Credential Guard disabled that connect to Wi-Fi, Ethernet or VPN using MS-CHAPv2. Single sign-on to those networks can fail.
What to do
  1. Find Wi-Fi, wired 802.1X and VPN profiles that use MS-CHAPv2 (PEAP-MSCHAPv2).
  2. Move them to certificate-based authentication, for example EAP-TLS with Intune-issued certificates.
  3. Use the temporary allow-and-audit registry setting in KB5066470 only while you migrate.
Source
Take action: NTLMv1 hardening changes might affect network connections on devices without Credential Guard“Beginning with the October 2026 security update, Windows 11, versions 26H2, 25H2, and 24H2, along with Windows Server 2025, enforce restrictions on generating NTLMv1-derived credentials for Single Sign-On by default.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

Passed (July 2026)MicrosoftEnforcementVendor gives the month only

Kerberos RC4 protections move to enforcement on domain controllers

Windows ServerActive Directory

Who is affected
Active Directory domains with service accounts or applications that still depend on RC4 Kerberos tickets. Audit mode and the temporary rollback registry setting were removed with this update.
What to do
  1. Review domain controller events for service tickets still requested with RC4.
  2. Enable AES on the affected service accounts and reset their passwords so AES keys exist.
  3. Retire or upgrade applications and appliances that cannot use AES.
Source
Enforcement phase for Kerberos RC4 protections begins with the July 2026 Windows security update“The July 2026 Windows security update enables Enforcement mode across Windows domain controllers for Kerberos RC4 protections related to CVE‑2026‑20833.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

138 days agoMicrosoftEnd of support

Secure Boot 2011 certificates start expiring (KEK CA 2011 and UEFI CA 2011)

WindowsWindows Server

Who is affected
Windows PCs, servers and virtual machines with Secure Boot that do not yet have the 2023 certificates. They keep booting, but cannot apply future Secure Boot updates signed with the new authorities.
What to do
  1. Check certificate status per device, for example with the Secure Boot status report in Windows Autopatch.
  2. Keep devices on current monthly updates, which deliver the new certificates in phases.
  3. Ask OEMs and hypervisor vendors for firmware or template updates where the update cannot apply.
Source
Secure Boot certificates expiring in 2026“Microsoft Corporation KEK CA 2011 | June 24, 2026 | Microsoft Corporation KEK 2K CA 2023 | Stored in KEK | Signs updates to DB and DBX.”
Manage Secure Boot certificate updates (Microsoft Learn)
Secure Boot certificates expiring in 2026“Microsoft UEFI CA 2011 * | June 27, 2026 | Microsoft UEFI CA 2023 | Stored in DB | Signs third-party boot loaders and EFI applications.”
Manage Secure Boot certificate updates (Microsoft Learn)
Tune in May 18 to ask Microsoft anything about Secure Boot“Secure Boot certificates start expiring in June of 2026.”
Windows message center (Windows release health, Microsoft Learn)

Checked 9 Nov 2026 Link to this deadline

How this list is made

  • Only dates stated on Microsoft Learn, Microsoft Lifecycle, Windows release health, Apple Developer or Apple’s published device management schema are included.
  • The quoted line is copied from that page. Where the date is only in a table, the row is quoted with cells separated by “|”.
  • Items without a vendor-stated date are left out, even when they are widely reported.
  • Days remaining are counted in UK time. A month or quarter counts as due for the whole period.