Windows 10 Firewall: block all – allow windows update

windows 10windows firewallwindows update

This is specific to windows 10 !!!

I need windows firewall to block all outgoing (and incoming) traffic EXCEPT for windows update but when I block the outgoing traffic –> windows update fails

I already tried allowing svchost completely as well as a lot of other services but still no windows update!!

It seems it only works when outgoing traffic is allowed 🙁

Thank you,
Lionel

Best Answer

It's almost useless blocking outgoing ports as applications need to send an initial response first to check the server's there (of which no reply will be recieved since the incoming port is blocked).

To only allow Windows Update to communicate, you need to block all incoming ports except the following domains and subdomains:

  • windowsupdate.microsoft.com
  • *.windowsupdate.microsoft.com
  • *.windowsupdate.microsoft.com
  • *.update.microsoft.com
  • *.update.microsoft.com
  • *.windowsupdate.com
  • download.windowsupdate.com
  • download.microsoft.com
  • *.download.windowsupdate.com
  • wustat.windows.com
  • ntservicepack.microsoft.com

You may be able to use the localhost file to block the above domains, by following the instructions here.

The above are not specific to any Windows version (although the TechNet page is for Windows Server 2003 and XP, this solution works with all modern Windows versions too), so it'll work on Windows versions other than Windows 10.

Related Question