We have a couple machines deployed to a retail environment and due to budget constraints, are limited to Windows Firewall as our firewall.
We inherently block all outgoing connections, and whitelist what we need. Unfortunately, whitelisting wuauserv service and svchost.exe is still blocking Windows Update from downloading updates, with error 80240438.
The firewall log shows the following:
2016-05-03 09:53:02 DROP TCP 192.168.10.21 184.108.40.206 49377 443 0 - 0 0 0 - - - SEND 2016-05-03 09:53:02 DROP TCP 192.168.10.21 220.127.116.11 49378 443 0 - 0 0 0 - - - SEND
Which I've verified are Microsoft IPs.
As far as I can tell, there is no way to whitelist the following hostnames in Windows Firewall.
http://windowsupdate.microsoft.com http://*.windowsupdate.microsoft.com https://*.windowsupdate.microsoft.com http://*.update.microsoft.com https://*.update.microsoft.com http://*.windowsupdate.com http://download.windowsupdate.com http://download.microsoft.com http://*.download.windowsupdate.com http://wustat.windows.com http://ntservicepack.microsoft.com
Is there anyway for Windows Update to work with Windows Firewall whitelisting?
I'm not specifically asking how to whitelist domain the names, more so asking how can I whitelist Windows Update as a whole.