Windows Firewall is blocking Windows Update

I recently uninstalled ZoneAlarm and have decided to use Windows Firewall as my firewall as ZoneAlarm was causing me grief when I was syncing my iphone.

Anyway, I've noticed just then that Windows Firewall seems to block my Windows updates.

Whenever I have the firewall on, I get a 8024402C error when I try to update, and it seems to update fine when I don't have the firewall on.

there is a help page for this error

but it seems to assume that the firewall I have is third party, I'm not sure how to fix it if Windows Firewall itself is the firewall that is blocking the automatic updates.

3

6 Answers

I've found solution.

I found it here.

Essentially I added a new incoming rule which allowed all connections coming from c:\windows\System32\svchost.exe.

I wonder why my default settings didn't already have this? Anyway it worked!

3

In Win 8 Go to Control Panel>Firewall>Advanced Settings. Then click Action>Export policy to make a copy of your current policy in case you want to restore it. Then click Action>New Rule>Custom>Next in the Program step of New Outbound Rule Wizard under the Service heading select Customize>Apply to this service>Windows Update>OK

Optional: Program: select "this program path" and select the program c:\windows\System32\svchost.exe press ok

Optional: Protocol and Ports: specify tcp port 443

Allow this connection; select your profile or leave as is (it should be explained in the wizard pretty well); give it a name; finish

2

Go to Control Panel>Firewall>Advanced Settings. Then click Action>Export policy to make a copy of your current policy in case you want to restore it. Then click Action>Restore Default Policy.

If it really is just the Firewall, this should allow you to use Windows Update.

1

Open Command Prompt as administrator and type the following commands, one by one (press ENTER after each command):

 - netsh winhttp reset proxy - net stop wuauserv - net start wuauserv

Try to install the updates again.

Source:

2

Here is how to change firewall settings in Windows 7, you can watch the video to learn the steps ;

Allow a program to communicate through Windows Firewall

By default, most programs are blocked by Windows Firewall to help make your computer more secure. To work properly, some programs might require you to allow them to communicate through the firewall.

Watch this video to learn how to allow a program to communicate through Windows Firewall (1:12)

Open Windows Firewall by clicking the Start button Picture of the Start button, and then clicking Control Panel. In the search box, type firewall, and then click Windows Firewall.

In the left pane, click Allow a program or feature through Windows Firewall.

Click Change settings. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Select the check box next to the program you want to allow, select the network locations you want to allow communication on, and then click OK.

WarningBefore allowing a program through the firewall, make sure you understand the risks involved. For more information, see What are the risks of allowing programs through a firewall?

2

In Windows 8 and 10, allowing the Windows Update service through the firewall is not enough. It appears to be because it uses a thread pool, but the security context is not correctly set on those threads, so they are not recognised by the firewall as being from Windows Update. (Link)

The solution that works for me was partially suggested by Uwe Bubeck on the Technet forums (Link):

1. Create a link to svchost.exe, for example mysvchost.exe, by using the command mklink /H mysvchost.exe svchost.exe. To do this, you will need permissions on svchost.exe.
2. Allow mysvchost through the firewall.
3. Change the ImagePath for the Windows Update service in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv from svchost to mysvchost.
4. Restart Windows Update to apply the change.
   You can now find updates, but they will not download.
5. Add an exception for TCP/80 on svchost.exe (i.e. all services). Updates can now be downloaded.

Before allowing all services TCP port 80, I tried adding an exception for TrustedInstaller, moving BITS (background transfer) to mysvchost, and some other services suggested by others such as cryptographic services. In the end, I couldn't find which service is responsible for downloading the updates, so I had to add an exception for all services. Downloading updates now works. If someone figures out the minimal set of changes, rather than a large whitelist for all services, please edit this answer (and maybe also post it to the technet threads).

2