Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I work with Windows Client and Server systems on a private network that cannot reach the internet. Problem is, many programs (like Subversion) cause Windows to attempt connections to www.download.windowsupdate.com to download a file called "authrootstl.cab" file. The direct result is that many programs that use SSL, like Subversion, block for five or ten seconds trying to resolve this host (which it never does).

I've tried putting this host to 127.0.0.1 or some other IP address in my C:\Windows\System32\Drivers\Etc\hosts file, but it still tries to look this up in DNS, and I assume it is bypassing the hosts file for security reasons.

Besides putting a dummy entry into a DNS server, which I cannot do, what other things can I try to stop or block this?

share|improve this question
add comment

3 Answers

Well, if you cannot touch the official DNS, perhaps you install a proxy DNS (on your workstation) that has a fake entry (pointing e.g. to 127.0.0.1) for www.download.windowsupdate.com, and that redirects all the other requests to the true DNS.

share|improve this answer
add comment

To make sure the problem is really a problem of resolution, you can enable the DNS client log (the DNS client is a service on Windows).

To do so, go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\LogFilePath

and optionally

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters\LogFileMaxSize 

Then have a look at what the subversion client does in that log. To make sure it really bypasses the hosts file, compare to the result of a manual:

nslookup -d2 www.download.windowsupdate.com
share|improve this answer
    
Alain, I don't have the registry path for DNS in the registry. Also, when I "ping" the host it does use 127.0.0.1. I think there is something internal that is disallowing us to locally remap that host name. –  Aegrotatio Mar 31 '11 at 14:23
    
You must create the Registry Path and Key. You might be right for the way the resolution is performed inside the subversion client, but I see no reason for this. The log should actually tell you how the resolution is performed. The other two solutions proposed in that thread are not bad and I would eventually resort to one of them (and actually did in the past), but I believe you first have to trace what's happening and that would involve creating/declaring and reading that log. –  Alain Pannetier Apr 1 '11 at 8:40
    
Well, I tried those keys and even tried replacing "DNS" with "dnscache" which does exist, but I never get any information in the log file I set. Still, I don't get why it's using DNS when that hostname is in the hosts file. I suspect there is an internal security setting that never uses the local hosts file for that host name. –  Aegrotatio Apr 6 '11 at 18:08
add comment

A clever solution I've used in the past is to push out a GPO or registry setting for a WSUS server that does not exist. The machines will then stop asking Microsoft for updates and instead fail to query for your missing server. Not exactly a clean solution, but it gets the job done.

You really should have a WSUS server, by the way.

share|improve this answer
    
+1 - I thought about this as well. I did not mention it because my understanding was that the OP had turned the windows update service off. Otherwise, yes that might be a way. But then setting a WSUS is not a common maintenance task. –  Alain Pannetier Apr 1 '11 at 18:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.