CPressland Posted March 24, 2011 Share Posted March 24, 2011 Hi guys, We've got a bit of an issue at the moment, we're using DeepFreeze to lock down our PCs on the call floor, the issue is that they're all redownloading Windows Updates automatically every morning. Now I'm going to go around and disable this so we can manually do it once every few months but immediately we need to have Windows Update blocked as our internet connection is barely functioning right now. Can anyone tell me what Domains / Ports etc Windows Update on Windows XP uses? Thanks Chris Link to comment Share on other sites More sharing options...
iuerg87yerg879e0rg9erugjer Posted March 24, 2011 Share Posted March 24, 2011 i believe update.microsoft.com is the hostname of the windows update servers, not sure about the port though, leme see if i can track it down (Y) edit: windows update services use port 80 and 443, lol http://technet.microsoft.com/en-us/library/bb490846.aspx Link to comment Share on other sites More sharing options...
amon91 Posted March 24, 2011 Share Posted March 24, 2011 update.microsoft.com? I guess you could just block that? Or just make another deep freeze with Windows Update disabled? Link to comment Share on other sites More sharing options...
jamesclarke555 Posted March 24, 2011 Share Posted March 24, 2011 Why aren't you using group policy? Link to comment Share on other sites More sharing options...
briangw Posted March 24, 2011 Share Posted March 24, 2011 Why aren't you using group policy? Or just disable the Windows Update services. Link to comment Share on other sites More sharing options...
Riggers Posted March 24, 2011 Share Posted March 24, 2011 Does the router allow wildcards? so you could use *.windowsupdate.microsoft.com or *.update.microsoft.com if not remeber to block https as well as http (not sure if it makes any difference but you may as well) Link to comment Share on other sites More sharing options...
Lilrich Posted March 24, 2011 Share Posted March 24, 2011 Windows update uses the following DNS for updates; update.microsoft.com windowsupdate.microsoft.com you could block these at the firewall if your router supports DNS blocking that would be the simple option i guess. If you have a Windows Server you could implement a group policy? EDIT: Riggers beat me to it Link to comment Share on other sites More sharing options...
CPressland Posted March 24, 2011 Author Share Posted March 24, 2011 Hey guys, Blocking those two hostnames seams to have done the job for now, well enough at least. I'll update these PCs manually in a few weeks then disable Windows Update on them. Which group policy are you guys talking about? They're hooked up to a Server 2008 R2 Domain Controller. Link to comment Share on other sites More sharing options...
Shaun N. Posted March 24, 2011 Share Posted March 24, 2011 Are you the IT guy? you could use update services to allow/block certain updates to roll out to the PC's on your domain. http://en.wikipedia.org/wiki/Windows_Server_Update_Services Link to comment Share on other sites More sharing options...
Teebor Posted March 24, 2011 Share Posted March 24, 2011 Through Group policy you can control Windows Update, ideally you would do this with WSUS (free) to give you a centralized control of updates allowing you to control what does and what does not get installed Then when you want to apply an update you OK it in WSUS and all the machines will download it per the scheduling you have already laid out Link to comment Share on other sites More sharing options...
sc302 Veteran Posted March 24, 2011 Veteran Share Posted March 24, 2011 Through Group policy you can control Windows Update, ideally you would do this with WSUS (free) to give you a centralized control of updates allowing you to control what does and what does not get installed Then when you want to apply an update you OK it in WSUS and all the machines will download it per the scheduling you have already laid out This, also you can have deepfreeze thaw during a scheduled time period so that updates can be applied. Say between 3am to 5am on thrusdays for example (a time that usually no one is working). Eric 1 Share Link to comment Share on other sites More sharing options...
CPressland Posted March 24, 2011 Author Share Posted March 24, 2011 Yeah, controlling Windows Update via Group Policy isn't really worth it, nor is WSUS, When we move to a Windows Multipoint Server base or move from XP to 7 then I'll worry about such things. These machines are used for a basic Java app and nothing else, so updates are barely important, they're even firewalled off from 99.9% of the web. I'll just let them be and disable automatic updates soon as I get time. Spending time fixing up PCs from the dark ages isn't my concern, ensuring it doesn't affect the productivity of the office is my concern. lol. Link to comment Share on other sites More sharing options...
Shaun N. Posted March 24, 2011 Share Posted March 24, 2011 99.9% eh! well I guess Windows Update was the 0.1%? Link to comment Share on other sites More sharing options...
sc302 Veteran Posted March 24, 2011 Veteran Share Posted March 24, 2011 Yeah, controlling Windows Update via Group Policy isn't really worth it, nor is WSUS, When we move to a Windows Multipoint Server base or move from XP to 7 then I'll worry about such things. These machines are used for a basic Java app and nothing else, so updates are barely important, they're even firewalled off from 99.9% of the web. I'll just let them be and disable automatic updates soon as I get time. Spending time fixing up PCs from the dark ages isn't my concern, ensuring it doesn't affect the productivity of the office is my concern. lol. 30 min gets you wsus and the appropriate group policies in place (even to disable windows updates for those specific machines, this would take 5 min if you have a domain). Dunno how it isnt worth it. Dunno how WSUS isn't worth free. Shaun N. 1 Share Link to comment Share on other sites More sharing options...
CPressland Posted March 24, 2011 Author Share Posted March 24, 2011 Where exactly is this group policy to disable Windows Update? WSUS isn't worth the Disk Space on the server, I've got 10TB of Call Recordings to manage and archive over the coming months. Link to comment Share on other sites More sharing options...
sc302 Veteran Posted March 24, 2011 Veteran Share Posted March 24, 2011 computer configuration admin templates windows components windows update Configure automatic updates "If the status is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, go to http://windowsupdate.microsoft.com or click Start, click Programs (or click All Programs), and then click Windows Update." This is a computer setting so it applies only to computers, add the computers that you want to apply this gpo to not the users within the group policy management console in active directory. Link to comment Share on other sites More sharing options...
CPressland Posted March 24, 2011 Author Share Posted March 24, 2011 Can't see it. Sorry, Linux is where i'm familier, Server 2008 R2 is still kinda a mystery to me. Link to comment Share on other sites More sharing options...
sc302 Veteran Posted March 24, 2011 Veteran Share Posted March 24, 2011 On the Domain Controller, Start, Administrative tools, Group Policy Management Console. Make a new group policy under the main domain name, edit the policy. I will provide screen shots in my next post, I will start getting them done now. Link to comment Share on other sites More sharing options...
abecedarian paradoxious Posted March 24, 2011 Share Posted March 24, 2011 If this is a real issue, it's time to rethink your network's configuration. This should've been worked out when Windows Update was introduced, not now. Link to comment Share on other sites More sharing options...
sc302 Veteran Posted March 24, 2011 Veteran Share Posted March 24, 2011 Sorry I forgot that you had to enable it...der http://technet.microsoft.com/en-us/library/cc725932.aspx Link to comment Share on other sites More sharing options...
CPressland Posted March 24, 2011 Author Share Posted March 24, 2011 Cool, that policy is setup. Now how to add the PCs to it...... Link to comment Share on other sites More sharing options...
sc302 Veteran Posted March 24, 2011 Veteran Share Posted March 24, 2011 when you are in the group policy management console, you single click on the policy on right it displays scope tab, at the bottom of the scope tab there is security filtering. add computers in there. You will have to modify the object type to include computers to be able to add them. then on a computer that is going to be effected by the group policy you can force it to apply by going to a command prompt and typing in: gpupdate to verify that this has been applied you can either use the gpresults command or going to start run rsop.msc and navigating to the windows update section. All pcs will follow suit within 15-45 min, you may want to schedule a one time thaw so that these updates can take place and be in there always, even after a reboot. Very powerful the group policies are, I would suggest making group policies as granular as possible. They can really lock down a computer. The computer configuration section applies to computers, the user configuration section applies to users. If you change something to the computer configuration and try to apply that to users it will will not apply and if you change something in the user configuration and have that apply to computers it will not apply. You can make groups and apply policies to groups (you can put computers in a group). Link to comment Share on other sites More sharing options...
Recommended Posts