MC1465017 Low
Reminder: Configure firewall and proxies for smooth Windows updates
Summary AI-generated
Update firewall/proxy configs to allow full access to all *.update.microsoft.com subdomains for Windows Update; improper config blocks updates and security patches.
Suggested actions AI-generated
- Check Windows Update audit log for connection issues
- Use PowerShell command and error codes from guidance to confirm faults
- Add all *.update.microsoft.com subdomains to proxy and firewall allow lists
- Review if exceptions are needed (not required for WSUS-managed devices)
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1388718 Microsoft Defender for Endpoint: Update to Linux connectivity requirements with new service URLs to allowlist
- MC1183282 Reminder: Update firewall configurations to include new network endpoints
- MC1178653 Take Action: Out-of-band update to address a vulnerability in Windows Server Update Services (WSUS)
- MC1242687 Prepare devices for successful updates with Windows Autopatch update readiness
- MC1427962 Network best practices for Teams town halls and live events with third‑party providers
- MC1462915 (Updated) Allow connections to copilot.cloud.microsoft before the Copilot URL redirect
Original post from Microsoft
What and why
By design, Windows Update doesn't trust servers that don't have TLS certificates issued by an actual Windows Update trust anchor. We published guidance in May 2026 to help you diagnose and fix connection issues that result from this design.
Rollout schedule
- This guidance was published in May to help with ongoing troubleshooting.
- Connection issues might be ongoing until you apply the existing solution.
Impact on your organization
Your firewalls and proxies might block access to the trustworthy and necessary Windows Update service if your configuration is either intercepting TLS connections or isn't passing TLS requests through for the necessary DNS subdomains. The published guide helps you diagnose and fix related issues.
Action required/recommendations
Diagnose connection issues by checking the Windows Update audit log. Our detailed guidance lists the recommended PowerShell command and four error codes that can confirm the issue.
To remedy the situation, trust all the DNS hosts and subdomains related to wildcard FQDN for the connection to work properly. For example, a recommended DNS host name *.update.microsoft.com represents all the following hosts and subdomains:
- update.microsoft.com
- sls.update.microsoft.com
- tas02.sls.update.microsoft.com
Update your proxy and firewall configurations if any of these subdomains are missing. If your devices connect to an IT-managed Windows Server Update Services (WSUS) server, these exceptions aren't necessary.
Compliance considerations
Devices that cannot reach the Windows Update service will stop receiving security updates.
Additional information