Blocking Windows Update via Router


Recommended Posts

Hi guys,

We've got a bit of an issue at the moment, we're using DeepFreeze to lock down our PCs on the call floor, the issue is that they're all redownloading Windows Updates automatically every morning. Now I'm going to go around and disable this so we can manually do it once every few months but immediately we need to have Windows Update blocked as our internet connection is barely functioning right now.

Can anyone tell me what Domains / Ports etc Windows Update on Windows XP uses?

Thanks

Chris

Link to comment
https://www.neowin.net/forum/topic/984862-blocking-windows-update-via-router/
Share on other sites

i believe update.microsoft.com is the hostname of the windows update servers, not sure about the port though, leme see if i can track it down (Y)

edit: windows update services use port 80 and 443, lol

http://technet.microsoft.com/en-us/library/bb490846.aspx

Windows update uses the following DNS for updates;

update.microsoft.com

windowsupdate.microsoft.com

you could block these at the firewall if your router supports DNS blocking that would be the simple option i guess.

If you have a Windows Server you could implement a group policy?

EDIT: Riggers beat me to it

Hey guys,

Blocking those two hostnames seams to have done the job for now, well enough at least. I'll update these PCs manually in a few weeks then disable Windows Update on them.

Which group policy are you guys talking about?

They're hooked up to a Server 2008 R2 Domain Controller.

Through Group policy you can control Windows Update, ideally you would do this with WSUS (free) to give you a centralized control of updates allowing you to control what does and what does not get installed

Then when you want to apply an update you OK it in WSUS and all the machines will download it per the scheduling you have already laid out

  On 24/03/2011 at 14:23, Teebor said:

Through Group policy you can control Windows Update, ideally you would do this with WSUS (free) to give you a centralized control of updates allowing you to control what does and what does not get installed

Then when you want to apply an update you OK it in WSUS and all the machines will download it per the scheduling you have already laid out

This, also you can have deepfreeze thaw during a scheduled time period so that updates can be applied. Say between 3am to 5am on thrusdays for example (a time that usually no one is working).

Yeah, controlling Windows Update via Group Policy isn't really worth it, nor is WSUS, When we move to a Windows Multipoint Server base or move from XP to 7 then I'll worry about such things. These machines are used for a basic Java app and nothing else, so updates are barely important, they're even firewalled off from 99.9% of the web.

I'll just let them be and disable automatic updates soon as I get time.

Spending time fixing up PCs from the dark ages isn't my concern, ensuring it doesn't affect the productivity of the office is my concern. lol.

  On 24/03/2011 at 15:59, Vegetunks said:

Yeah, controlling Windows Update via Group Policy isn't really worth it, nor is WSUS, When we move to a Windows Multipoint Server base or move from XP to 7 then I'll worry about such things. These machines are used for a basic Java app and nothing else, so updates are barely important, they're even firewalled off from 99.9% of the web.

I'll just let them be and disable automatic updates soon as I get time.

Spending time fixing up PCs from the dark ages isn't my concern, ensuring it doesn't affect the productivity of the office is my concern. lol.

30 min gets you wsus and the appropriate group policies in place (even to disable windows updates for those specific machines, this would take 5 min if you have a domain). Dunno how it isnt worth it. Dunno how WSUS isn't worth free.

computer configuration

admin templates

windows components

windows update

Configure automatic updates

"If the status is set to Disabled, any updates that are available on Windows Update must be downloaded and installed manually. To do this, go to http://windowsupdate.microsoft.com or click Start, click Programs (or click All Programs), and then click Windows Update."

This is a computer setting so it applies only to computers, add the computers that you want to apply this gpo to not the users within the group policy management console in active directory.

On the Domain Controller, Start, Administrative tools, Group Policy Management Console.

Make a new group policy under the main domain name, edit the policy. I will provide screen shots in my next post, I will start getting them done now.

when you are in the group policy management console, you single click on the policy on right it displays scope tab, at the bottom of the scope tab there is security filtering. add computers in there. You will have to modify the object type to include computers to be able to add them.

then on a computer that is going to be effected by the group policy you can force it to apply by going to a command prompt and typing in:

gpupdate

to verify that this has been applied you can either use the gpresults command or going to start run rsop.msc and navigating to the windows update section. All pcs will follow suit within 15-45 min, you may want to schedule a one time thaw so that these updates can take place and be in there always, even after a reboot.

Very powerful the group policies are, I would suggest making group policies as granular as possible. They can really lock down a computer. The computer configuration section applies to computers, the user configuration section applies to users. If you change something to the computer configuration and try to apply that to users it will will not apply and if you change something in the user configuration and have that apply to computers it will not apply.

You can make groups and apply policies to groups (you can put computers in a group).

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Just checked for updates on my Windows 11  machines and my Windows 10 machines. Windows 10 is getting the June cumulative but my Windows 11 machines aren't finding a June cumulative.  Odd.
    • Microsoft to default-block more files in New Outlook and Outlook Web by Sayan Sen Back in 2019, Microsoft announced a big change to its list of blocked file types for attachments. At the time, Microsoft stated that it was doing so to improve security by adding "file extensions to the BlockedFileTypes property of existing OwaMailboxPolicy objects." The tech giant deems such file types as no longer secure for attachments and is a good way to protect customers from potentially malicious attacks from threat actors. Over time the company has expanded the block list for Outlook for the Web and also the New Outlook for Windows app. In a new message via the Microsoft 365 Admin Center portal, the company has announced that two more such file types will be added. However, the tech giant feels this should not affect most users, as these "newly blocked file types are rarely used." It writes: "As part of our ongoing efforts to enhance security in Outlook Web and the New Outlook for Windows, we’re updating the default list of blocked file types in OwaMailboxPolicy. Starting in early July 2025, the following file types will be added to the BlockedFileTypes list: .library-ms .search-ms" For admins, Microsoft says that no action is required if their respective organisations do not rely on the aforementioned file attachments. However, if they are still in use, then admins can "add them to the AllowedFileTypes property of your users’ OwaMailboxPolicy objects before the rollout." Speaking of which, this is set as a "major change" with the rollout expected to start in early July 2025. You can find information on how to do that in the official documentation on Microsoft's website here. For those wondering, the following file types are allowed by default: ".avi, .bmp, .doc, .docm, .docx, .gif, .jpg, .mp3, .one, .pdf, .png, .ppsm, .ppsx, .ppt, .pptm, .pptx, .pub, .rpmsg, .rtf, .tif, .tiff, .txt, .vsd, .wav, .wma, .wmv, .xls, .xlsb, .xlsm, .xlsx, .zip" You can find the list of blocked file types here on this Microsoft support article on the company's official website. If you are a system admin, you can view the message on the Microsoft 365 Admin Center under ID MC1090702.
    • Thanks Nik. This card is kinda what I'm looking for. Do you know if this connects to the motherboard via the TB Header / JTBT1 Header or if this is via the PCI Express slot? I was wondering if there was just a cable I could purchase that would give me a TB connection, since the header is already on the mainboard. Thanks
    • Adobe Acrobat Reader DC 2025.001.20531 by Razvan Serea Adobe Acrobat Reader DC software is the free, trusted standard for viewing, printing, signing, and annotating PDFs. Its the only PDF viewer that can open and interact with all types of PDF content – including forms and multimedia. It’s connected to Adobe Document Cloud – so you can work with PDFs on computers and mobile devices. Adobe Document Cloud is a revolutionary, modern and efficient way to get work done with documents in the office, at home or on-the-go. At the heart of Document Cloud is the all-new Adobe Acrobat DC, which will take e-signatures mainstream by delivering free e-signing with every individual subscription. Document Cloud includes a set of integrated services that use a consistent online profile and personal document hub. With Adobe Document Cloud, people will be able to create, review, approve, sign and track documents whether on a desktop or mobile device. Businesses will be able to take advantage of Document Cloud for enterprise which provides enterprise-class document services that integrate into systems of record such as CRM, HCM, CLM, and CMS, adding speed, efficiency and transparency to getting business done with documents. Adobe Acrobat Reader DC new feature highlights: Work with PDFs from anywhere with the new, free Acrobat DC mobile app for Android or iOS. Select functionality is also available on Windows Phone. Use the new Fill & Sign tool in your desktop software to complete PDF forms fast with smart autofill. Download the free Adobe Fill & Sign mobile app to add the same option to your iPad or Android tablet device. Save money on ink and toner when printing from your Windows PC. Store and access files in Adobe Document Cloud with 5GB of free storage. Get instant access to recent files across desktop, web, and mobile devices with Mobile Link. Sync your Fill & Sign autofill collection across desktop, web, and iPad devices. Adobe PDF Pack premium features includes: Convert documents and images to PDF files. Use your mobile device camera to take a picture of a paper document or form and convert it to PDF. Turn PDFs into editable Microsoft Word, Excel, PowerPoint, or RTF files. Combine multiple files into a single PDF (web only). Get signatures from others with a complete e-signature service. Send, track, and confirm delivery of documents electronically instead of using fax or overnight services (tracking not available on mobile). Store and access files online with 20GB of storage. Download: Adobe Acrobat Reader DC 64-bit | 626.0 MB (Freeware) Download: Adobe Acrobat Reader DC 32-bit | 516.0 MB Link: Adobe Acrobat Reader DC Home Page | Release Notes | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • Reacting Well
      Alan- earned a badge
      Reacting Well
    • Week One Done
      IAMFLUXX earned a badge
      Week One Done
    • One Month Later
      Æhund earned a badge
      One Month Later
    • One Month Later
      CoolRaoul earned a badge
      One Month Later
    • First Post
      Kurotama earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      494
    2. 2
      ATLien_0
      268
    3. 3
      +FloatingFatMan
      223
    4. 4
      +Edouard
      200
    5. 5
      snowy owl
      141
  • Tell a friend

    Love Neowin? Tell a friend!