Windows Update problem

[duttyend]

Dear @henrypp ,

The new version (2.3.1.) introduced a regression regarding Windows Update (was working fine with 2.3, 2.2.12 and below).

Using Windows Update Mini Tool, I get those error messages :
[13:14:15]: Start Windows Update Service
[13:14:15]: Windows Update Service enabled
[13:14:17]: Searching for updates
[13:14:17]: An error has occurred: 0x80072EFD

My simplewall configuration is as follows (and was the same with 2.3) :
Settings > Rules > System rules > Windows Update enabled
On the main simplewall screen, I see that you added wuauserv to the list, I checked the box to include it in Allowed apps but I still get the same error.

Thanks a lot for your time !

[henrypp]

2.3.1 fixed?

[duttyend]

No, unfortunately. And version 2.3.2 neither fixed it.
I see that you have removed "Windows Update" from System rules so I added Windows Update service to my whitelist but it still doesn't work.

[hesss5]

try allow BITS service see work or not

[hesss5]

or according to here
http://www.tomshardware.com/faq/id-3128557/fix-windows-error-0x80072efd.html
allow service which start with winhttp

[duttyend]

Thanks @hesss5 , I tried adding BITS service and the only WinHTTP service there is on my Windows 10 1709, but still the same error...

[ghost]

Happened to me all the time but eventually it stopped. I managed to fix it by running wu170509.diagcab, not sure the tool name but it looks like this https://support.microsoft.com/help/2714434/description-of-the-windows-update-troubleshooter

Had to run that tool for every single update, for weeks. Windows 10 is just pure shit.

[beerisgood]

@whytho2000 then i wonder why win10 runs here on three systems without problems. And no its not shit. If you dont like it, dont use it?!

[duttyend]

Thanks @whytho2000 , I have tried the troubleshooters and resetting all components, it doesn't fix the problem.
I really think the root is within the newest changes made from version 2.2.12 because when I disable filtering , Windows Update works fine, as it did with previous simplewall versions.

[ghost]

@beerisgood pottery https://github.com/beerisgood/Windows10_Anti-Telemetry

What, do you think I'm some redditor who chooses /r/linux or /r/windows10 like it's some kind of exclusive club? I think osx and linux are mostly shit, and I use them too, but I'm forced to use Windows 10 because things I need only runs there. It's just sad how much wasted potential W10 has when it could be the best OS out there if MS haven't decided to monetize the shit out of it instead of making a good OS

@duttyend you need to disable the extra_ and spy_ filters too for it to work (when updating), I'm not sure which ones so I just disable them all, and several exe's that I can't remember exactly right now (but you'll get the notification)

[MVoz]

@henrypp 2.3.2 fixed!

@whytho2000 https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ee424379(v=ws.10)

Windows 10 Ent - ok

"C:\Windows\System32\msdt.exe" -ID WindowsUpdateDiagnostic

[duttyend]

@whytho2000 I disabled every spy_filter but it didn't solve the problem unfortunately... what makes me think it is due to a new change is because until version 2.3, everything was working fine

[kevin2xk]

I just installed 2.3.2 today (new user) and Windows Updates worked properly after installing simplewall. Seems like something on your end.

[beerisgood]

I dont have problems after update to latest Version

[henrypp]

It's not a bug, it's feature.

Old version of "Windows Update" system rule will allows ALL http/https traffic through svchosts.exe, it is not safe, because service hosts have most of features (like BITS or another shit) for passthrough network restriction, send telemetry etc...

New version of "Windows Update" system rule allows only wuauserv, but there have one mistake: on different OS it worked different, on Win7 it working when you allows wuauserv, on Win8+ it worked partially, most of traffic going though wuauserv rule, and then blocked downloading for service host svchosts.exe and i testing what another rule needs to add for Win8+ to allows WU entirely.

People who do not have problems with WU, maybe you are allows svchosts.exe entirely?

[hesss5]

will i disabled windows update.
i use WHDownloader to get update :)

[duttyend]

@henrypp You are right, it is related to the default blocking of svchosts.exe, which I disabled notifications for. I tried enabling notifications and could see the requests to connect to various IP addresses (mainly 13.74.179.117 and 64.4.54.18).

[beerisgood]

@henrypp you're right. I allowed svchosts.exe entirely

[henrypp]

@beerisgood it's not good, it really not good, svchosts is a root of tree for telemetry in all window$ versions.

[beerisgood]

No Problem. I disable telemetry in Windows and use PiHole

[TontyTon]

@henrypp You may find this helpful https://support.microsoft.com/en-us/help/3084568

[henrypp]

upd for v3:

Here is final solution:

• Install latest SW v3
• Open settings->blocklist-> Set "MS update servers" as "Allow"
• ???
• PROFIT!!!

[Tom4tot]

Her is temporary solution:

• Download and install this custom blocklist ("custom" means all update entries are allowed)
• Unpack as blocklist.xml to simplewall profile directory.
• Restart simplewall
• Open settings and check ALL update-* entries
• ???
• PROFIT!!!

This is temporary, because now i dont mind how can integrate this feature into simplewall.

Thank you for feeding us with a solution! However, in my installation folder (portable), I don't have a "profile" directory. Should I just create one?

[henrypp]

However, in my installation folder (portable), I don't have a "profile" directory. Should I just create one?

@Tom4tot, "profile" directory is a directory where simplewall.ini file located. For portable build this is simplewall directory, for setup build this is %APPDATA%\Henry++\simplewall

[Tom4tot]

However, in my installation folder (portable), I don't have a "profile" directory. Should I just create one?

@Tom4tot, "profile" directory is a directory where simplewall.ini file located. For portable build this is simplewall directory, for setup build this is %APPDATA%\Henry++\simplewall

I confirm it's working perfectly. Thank you again! Don't forget you can select multiple entries and then checking them all together. :D

[itsvolodya]

How about the fact, that when simplewall asks about installing new version on startup, it can't actually install one, because an error like "simplewall is running, can't install" pop-ups? But if I open simplewall and manually check updates, then things go smoothly. Should I open a new issue?

[henrypp]

@itsvolodya

Володя - это не баг, просто закрой simplewall и нажми "продолжить".

[pwn0r]

FYI for everyone, this should serve as an entry point for all searches on the similar queries.
keywords: windows update services, firewall, wuauserv, WFP

Right, the current rule on windows update only allows wuauserv service which is not enough since windows 8.1. Even more so on windows 10.

For starters, on windows 10 you need to have ideally BITS and DoSVC services allowed as well. The latter one iirc is the one using p2p downloads for updates.

The updates for UWP apps are done differently (that obviously apply only to win10). For universal apps you need wlidsvc, installservice and a microsoft store app itself to be allowed on the firewall.

However the fundamental problem with updates now is that they don't use just one service context for threads.
To quote a technet user Jani:

I did a bit of digging. Turns out this is because Windows Update uses a thread pool to run the connection. Since there is only one thread pool per svchost [1], from the firewall point of view they all look the same and are not attached to any service [2]. I have no idea how to workaround this though.

More useful in-depth discussion here:
https://social.technet.microsoft.com/Forums/windows/en-US/27ded2ad-cc85-4c0a-9b41-c6b469a20aab/windows-firewall-and-windows-update-win-81

Basically, people are left with a few options:

1. Enable temporarily svchosts (like 10min) and download/install updates. Then disable it again.
2. Create as per discussion above a different process context for svchosts (ppl advice to use a symlink rather than copy) and move services which need internet access to there. then you can enable outgoing connections only for the services which actually need that.
3. Make a special rule for svchost. What you need to do is to enable outbound connections for a few (like 3-4) IP addresses (and just port number 443 is enough) which are used in your region. You can find out specific addresses by checking your dropped packets log. Then you can use mini-updates tool for download and installation.

Alternatively, either install WSUS services in your LAN and link updates to it, or entirely skip automatic updates. Use either WHDownloader as per above, or simply discover https://www.catalog.update.microsoft.com and download them manually in your browser.

[Trass3r]

Is there an update? I saw the custom blocklist is "not needed anymore": 4ae3330#diff-c1111bd512b29e821b120b86446026b8
Now with v3 I enabled services active during an update like wuauserv, BITS, DoSvc, UsoSvc, LicenseManager, wlidsvc, DnsCache. But still with the firewall enabled I get an error "couldn't connect to the update service"

[henrypp]

@Trass3r

[Tom4tot]

@Trass3r

FYI, on Windows 10 1903, this option doesn't work. I need to allow svchost.exe like it was already the case. Now that we have timers, it's not a huge issue but I just wanted to let you know. I'm not sure there's fix for W10 unfortunately.

[henrypp]

@Tom4tot yes, 1903 have significant changes and need to add some ip addresses into user rules (but do not enable svchost.exe, it's a shame)

[beerisgood]

@henrypp I guess you mean Windows telemetry? Can be blocked with PiHole for example

[henrypp]

@bugefo

why enable svchost port 443 is not correct and is shame? (windows v1903 only way is enable that)

svchost is a service host, a lot of services (including telemetry, spying and other ~BS) can pass internet without reason.

SW have a rules editor and logs of dropped packets, this feature has added for fine tuning of internet access. I know, a lot of people simply allow svchosts, but SW is for advanced users, not for "pros" like this.

[henrypp]

Windows 10 1903 updates fixed, thank you @crazy-max!

[fredgolightly]

Same as 446 - Windows Update doesn't work and despite enabling svchost.exe it still gets logged as dropeed:
C:\windows\system32\svchost.exe","64.4.54.18:443",TCP,"simplewall\extra_64.4.54.18",#383127,OUT,BLOCK

I have the allow ms updates enabled, but that alone doesn't fully work. I've had to add svchost at 443 until SW is working natively to allow WU

[henrypp]

@fredgolightly try allow MS apps too ("extra_64.4.54.18" is a MS apps rule).

[fredgolightly]

Seems to work, thanks! I'd rather have ms apps blocked while having ms update working, this seems a bit of a work around - could you perhaps look at integrating the extra_64... into the MS update setting rather than the ms apps one? Essentially, MSUpdate should allow ms update to work fully on its own

[dm413]

It still doesn't work for me. I have a new laptop running Win10 pro, it came with version 1809 pre-installed. I installed simplewall 3.0.5, with the default settings. Windows update says it can't connect.

I created a rule allowing port 443 for svchost.exe. Windows update gets a little further -- it reports that my device is missing important fixes, but then again says it can't connect to the update service.

If I allow svchost.exe in general (without the port 443 rule), everything updates.

Am I doing something wrong? Thanks,

[henrypp]

@dm413

I created a rule allowing port 443 for svchost.exe. Windows update gets a little further -- it reports that my device is missing important fixes, but then again says it can't connect to the update service.

Am I doing something wrong?

i think yes, but you can

[dm413]

After getting my system to update to 1903, and applying all subsequent updates (and 4 or 5 reboots!) now Windows Update seems to work without allowing svchost or creating a 443 rule. I can't tell for sure, since there are no updates to download, but Check for updates shows no error message and appears to succeed.

I suspect that the fixes that allow 1903 to work broke it working with 1809 (though this is really just wild speculation on my part).

Thanks for your help, and for this software.

[dm413]

I spoke to soon. After 20 minutes, I tried again, and update fails (can't connect to update service). I enabled the port 443 rule, and update succeeds. Removed the 443 rule and update fails again.

I have seen this before on an older win10 system I have -- sometimes windows update will succeed, but then a short time later it will start failing again. Nothing has changed in the meantime.

I do have update servers enabled in simplewall settings -- that's how it was set by default.

[SoyRA]

• Install latest SW v3
• Open settings->blocklist-> Set "MS update servers" as "Allow"
• ???
• PROFIT!!!

It doesn't work for me, and I've restarted the PC with every change I made. :c!
- SW : 3.0.9 x64
- W10 : 1909 (19H2)
Updates in Microsoft Store don't work either.

---- EDIT 1 ----

Sometimes it works and sometimes it doesn't. 🙃

[iamalexei]

Hi @henrypp ! Setting "MS update servers" to "Allow" doesn't worked for me too—I got an error while trying to download an app from Microsoft Store. After looking into the log file, I've created the following rule for svchost.exe: Remote: 443;80 Local: 50745-50765 which allowed me to download/update apps from the Store.

simplewall 3.1.2 64-bit
Windows 10 Home 1909

Also, I know a working solution how to disable Windows Security center warnings for W10 Home 1909 (those solutions in the FAQ section don't work):

1. Open regedit.exe;
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft and create a new Key "Windows Defender Security Center";
3. Go to the newly created Key and add a new Key "Notifications" inside;
4. In the previously created "Notifications" Key (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications) create two DWORD (32-bit) values: DisableEnhancedNotifications and DisableNotifications, and change their value data to 1.

Hope it would be helpful

[ghost]

Аналогичная проблема на Windows 8.1 x64 Pro. Причём обновление работает через раз.
В настройках программы установлены разрешающие галки напротив Сервер Обновления и Сервер Приложения. При первой попытке обновиться, появляется ошибка соединения. По логам создаю правило и обновление происходит. После чего отключаю только что созданное правило, в SW жму "Обновить" и запускаю поиск новых обновлений. В этот раз уже не появляется ошибка соединения. Хотя правило отключено.
Обновление времени и дефендера тоже не работают без создания дополнительных правил.

[Kein]

Use the svchost workaround provided here:
#677

If your PC has less than 4GB of RAM you might wanna also set service type to non-shared