Which IP Addresses Or URLs Does Windows Update Use?

To constrain web browsing on several PCs I've blocked all HTTP and HTTPS
traffic using my router. However, I want Windows Update to work on those same
PCs. Some of the PCs are running Windows 2000, some Windows 2003, and some
Windows XP. Which IP addresses (or URLs) should I ALLOW in my router tables
so that I don't prevent Windows Update from working?

Richard Huelbig wrote:

> To constrain web browsing on several PCs I've blocked all HTTP and HTTPS
> traffic using my router. However, I want Windows Update to work on those same
> PCs. Some of the PCs are running Windows 2000, some Windows 2003, and some
> Windows XP. Which IP addresses (or URLs) should I ALLOW in my router tables
> so that I don't prevent Windows Update from working?
Hi,

Open for TCP and UDP on ports 80 (HTTP) and 443 (HTTPS) for the
following sites:

*.download.microsoft.com
*.windowsupdate.com
*.windowsupdate.microsoft.com
windowsupdate.microsoft.com



--
torgeir, Microsoft MVP Scripting, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Thank you Torgeir the URLs are helpful. Since my router uses IP addresses and
not URLs for filtering, do you happen to know the IP addresses of the sites
you mention. Or, it not, I suppose I could simply PING the URLs and use the
resultant IP addresses. I appreciate your feedback.
Regards,
Richard Huelbig


"Torgeir Bakken (MVP)" wrote:

> Richard Huelbig wrote:
>
> > To constrain web browsing on several PCs I've blocked all HTTP and HTTPS
> > traffic using my router. However, I want Windows Update to work on those same
> > PCs. Some of the PCs are running Windows 2000, some Windows 2003, and some
> > Windows XP. Which IP addresses (or URLs) should I ALLOW in my router tables
> > so that I don't prevent Windows Update from working?
> Hi,
>
> Open for TCP and UDP on ports 80 (HTTP) and 443 (HTTPS) for the
> following sites:
>
> *.download.microsoft.com
> *.windowsupdate.com
> *.windowsupdate.microsoft.com
> windowsupdate.microsoft.com
>
>
>
> --
> torgeir, Microsoft MVP Scripting, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx
>

Hello,

I have also opened Ports 80 (internet access) to port 80 (internal port) for
TCP and UDP, the same for 443. But Windows Update is not getting really
connected. I ongoing get the web page with "Install the ActiveX control
required to view the website". Are there maybe other ports which are used for
Windows Update?

Yours
Stephan.


"Richard Huelbig" wrote:

> Thank you Torgeir the URLs are helpful. Since my router uses IP addresses and
> not URLs for filtering, do you happen to know the IP addresses of the sites
> you mention. Or, it not, I suppose I could simply PING the URLs and use the
> resultant IP addresses. I appreciate your feedback.
> Regards,
> Richard Huelbig
>
>
> "Torgeir Bakken (MVP)" wrote:
>
> > Richard Huelbig wrote:
> >
> > > To constrain web browsing on several PCs I've blocked all HTTP and HTTPS
> > > traffic using my router. However, I want Windows Update to work on those same
> > > PCs. Some of the PCs are running Windows 2000, some Windows 2003, and some
> > > Windows XP. Which IP addresses (or URLs) should I ALLOW in my router tables
> > > so that I don't prevent Windows Update from working?
> > Hi,
> >
> > Open for TCP and UDP on ports 80 (HTTP) and 443 (HTTPS) for the
> > following sites:
> >
> > *.download.microsoft.com
> > *.windowsupdate.com
> > *.windowsupdate.microsoft.com
> > windowsupdate.microsoft.com
> >
> >
> >
> > --
> > torgeir, Microsoft MVP Scripting, Porsgrunn Norway
> > Administration scripting examples and an ONLINE version of
> > the 1328 page Scripting Guide:
> > http://www.microsoft.com/technet/scr...r/default.mspx
> >

"Stephan (Germany)" <> wrote in message
news:95CC93F2-D435-4825-91A1-...
> Hello,
>
> I have also opened Ports 80 (internet access) to port 80 (internal port) for
> TCP and UDP, the same for 443. But Windows Update is not getting really
> connected. I ongoing get the web page with "Install the ActiveX control
> required to view the website". Are there maybe other ports which are used for
> Windows Update?


What do you mean by "port 80 (internal port)"?

If you mean the port used on the client side to make the outbound
connection I don't think that that will be sufficient for remote connections;
otherwise it would make it possible for you to operate your own web server
(e.g. specifying localhost:80 as an inbound port).

BTW this question is probably better handled in a newsgroup which
specializes in networking for your OS.

In any case here is an interactive troubleshooter which you can try.
It contains a link to an XP newsgroup which specializes in networking.

http://www.michna.com/kb/


Good luck

Robert Aldwinckle
---

I have a simular problem, port 80 and 443 are blocked so that our students
can not go around the proxy server (our required by law internet filter).
While I allow all these URL's on the proxy, some parts of windows update
utility do not go through the proxy in the system settings, and I see traffic
get stopped at the firewall.

Same issue, the firewall uses IP addresses not URL's. I too will try
pinging the url's and hopefully Microsoft does not change the addresses on us.

Thanks,
Chris

"Torgeir Bakken (MVP)" wrote:

> Richard Huelbig wrote:
>
> > To constrain web browsing on several PCs I've blocked all HTTP and HTTPS
> > traffic using my router. However, I want Windows Update to work on those same
> > PCs. Some of the PCs are running Windows 2000, some Windows 2003, and some
> > Windows XP. Which IP addresses (or URLs) should I ALLOW in my router tables
> > so that I don't prevent Windows Update from working?
> Hi,
>
> Open for TCP and UDP on ports 80 (HTTP) and 443 (HTTPS) for the
> following sites:
>
> *.download.microsoft.com
> *.windowsupdate.com
> *.windowsupdate.microsoft.com
> windowsupdate.microsoft.com
>
>
>
> --
> torgeir, Microsoft MVP Scripting, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx
>

I am having this same problem where I need to open my firewall to a specific
IP for Windows Updates. NSlooup gets a diffirent IP depending on what DNS
server I ping? When I try to go to that IP it only gets so far.

Does anybody know of a single IP for a Microsoft run WSUS server?

-Thanks

"Robert Aldwinckle" wrote:

> "Stephan (Germany)" <> wrote in message
> news:95CC93F2-D435-4825-91A1-...
> > Hello,
> >
> > I have also opened Ports 80 (internet access) to port 80 (internal port) for
> > TCP and UDP, the same for 443. But Windows Update is not getting really
> > connected. I ongoing get the web page with "Install the ActiveX control
> > required to view the website". Are there maybe other ports which are used for
> > Windows Update?
>
>
> What do you mean by "port 80 (internal port)"?
>
> If you mean the port used on the client side to make the outbound
> connection I don't think that that will be sufficient for remote connections;
> otherwise it would make it possible for you to operate your own web server
> (e.g. specifying localhost:80 as an inbound port).
>
> BTW this question is probably better handled in a newsgroup which
> specializes in networking for your OS.
>
> In any case here is an interactive troubleshooter which you can try.
> It contains a link to an XP newsgroup which specializes in networking.
>
> http://www.michna.com/kb/
>
>
> Good luck
>
> Robert Aldwinckle
> ---
>
>
>