Microsoft.Windows.Update Block but Microsoft.Store Allowed

[gavinr]

Hi All,

Application Control Requirement -> Block Windows Update

After blocking windows update (block Microsoft.Windows.Update) I can notice that users are unable to update apps from Microsoft Store. According to firewall logs Microsoft.Store is allowed. 

But, according to https://www.fortiguard.com/appcontrol/40503 Microsoft.Windows.Update is a dependency of Microsoft.Store 

Could anyone suggest how to block Microsoft.Windows.Update and allow Microsoft.Store?

[mzainuddinahm]

Hello gavinr,

Have you allowed Microsoft.Store in override list? Make sure it is on top of the override list & test.

Best Regards,

Mohammed Ahmed

[gavinr]

This is the Application Filter I am using.

I am not able to see any logs blocking too.

But when I full open (without app filter) user can download from Microsoft.Store

[mzainuddinahm]

Hello gavinr,

Since the Microsoft.Windows.Update carries dependency for Microsoft.Store, it may be using the same servers to update the apps which are defined in Microsoft.Windows.Update signature, hence is getting blocked. I am not sure if Microsoft would have different update servers when it comes to updating apps, it may be centrally used for all MS Updates.

Best Regards,

Mohammed Ahmed

[gavinr]

I assume the same.

Would there be any solutions for this? I mean block windows update but allow microsoft store....

[TekConsultancy]

 just create 2 rules 1 is block all windows update and 2 is top with just allow FQDN of https://apps.microsoft.com

[kpaz]

Hi TekConsultancy, I have the same problem and I already tried to do the same thing you mentioned but it still doesn't work only with the fqdn, I have to disable the Windows Update policy for downloads to work in the Microsoft Store. I show you the policies I configured