5 ms·

Two things I’ve always wanted to do is figure out how to cache windows updates on my local network without an enterprise windows install, and how to block windo

Two things I’ve always wanted to do is figure out how to cache windows updates on my local network without an enterprise windows install, and how to block windows updates by sinkholing domains and/or ip addresses (I work in IT security). Can anyone give any tips on either of these?

aoetalks 4y ago
Why do you want to block windows updates?
- hsbauauvhabzb 4y ago
  Because working in security sometimes I want to test malware on outdated AV, blocking full internet causes command and control failures, creating a weird spot to analyse traffic. Disabling Defender is not persistent (it seems to switch itself on, etc).
  - WolfRazu 4y ago
    If you disable defender using group policy, from my experience that's been disabled consistently for a year no problems. Latest version of Windows 10. Note you need to disable tamper protection and reboot first otherwise it silently reenables itself.
- alar44 4y ago
  It's standard practice. You don't roll out updates until they are tested.
  - videofreedom 4y ago
    Would you like to describe your standard practice? I am interested in implementing this after windows updates have killed our workstations multiple times. Is there a nice description / workflow / tutorial / script / community where I can learn how to do that? I did not find any recommended workflow for this by Microsoft itself, but maybe I was searching for the wrong things - windows updates are generally a bad thing to research anything related for. I expected to find some standard workflow description plus tools on some MS website, but no success. Does that exist? Thank you very much!
    - vetinari 4y ago
      You are looking for WSUS (Windows Server Update Services). If you have Windows Server somewhere, you can add WSUS role to it and use group policies to point your clients to it for updates. Then, in WSUS console, you set up approvals for updates and then the updates will be offered to clients only once you approve them. You can divide the clients into groups and manage the approvals for these groups individually, so you can have a separate testing group.
- TurkishPoptart 4y ago
  Because somehow it gets worse and less usable each time. Also, planned obsolescence.
- marginalia_nu 4y ago
  Sometimes Windows installs an upgrade that insists I must connect my user account to a Microsoft account. It will not let me boot the OS if I don't. Only hell if I know what my Microsoft account is. I never use it. I need to use my web browser to find out. But I can't, because I need to set up my Microsoft account first. So I have to use another computer which will let me use it even without a Microsoft account, and then try to figure out my Microsoft account password. Then boot into Windows, let it connect the accounts, go into account options and try to find the hidden dialog to separate them again because hell fucking no I don't want Microsoft to associate my user account with my email address. Being shafted like this every now and then has eroded my trust for Windows' updates.
  - josephcsible 4y ago
    > eroded my trust for Windows' updates Remember that security vulnerabilities in Windows are discovered all the time, so it's dangerous to use Windows without installing the updates. If you (rightfully) don't want to install the updates, then you should switch to an OS that actually respects your freedom instead, like Linux.
    - marginalia_nu 4y ago
      I can also just accept the risk. (I already do all my important work on Linux, since like 20 years)
omvtam 4y ago
The nuke-it-from-orbit approach works for me but ymmv: a default-deny firewall for the Windows IP on the default gateway with external squid proxy for Firefox. netstat -on | grep $PID to add rules to allow access per process for things that just have to get through.
me_again 4y ago
Look into WSUS / Windows Update Services
- amaccuish 4y ago
  He said "without an enterprise install"
mkup 4y ago
Set up SOCKS5 proxy (e.g. github.com/rofl0r/microsocks) on the nearest router and configure router's firewall to drop all outgoing packets whose TTL is near 128 (Windows). Then configure FoxyProxy in Firefox or Chrome to use your SOCKS5 proxy. Windows will think it's offline, browser and other apps which are aware of your proxy will work fine.
RunSet 4y ago
> how to cache windows updates on my local network without an enterprise windows install https://download.wsusoffline.net/ https://download.wsusoffline.net/ will download Windows updates and create an installer for them.
ddlutz 4y ago
I'm surprised "in-home router-level network caching" hasn't become a thing, really. Lets say you have a family of 4, all with iphones that need updating, windows updates, downloading same games from steam, app store, etc. It could be significantly sped up for whole house to download file 1 time instead of 4.
- hsbauauvhabzb 4y ago
  I believe Microsoft use BitTorrent to distribute updates. It took me a while to realise that many Linux distros use unencrypted http to enable caching, using signature checks to verify file integrity

aoetalks 4y ago

Why do you want to block windows updates?

hsbauauvhabzb 4y ago
Because working in security sometimes I want to test malware on outdated AV, blocking full internet causes command and control failures, creating a weird spot to analyse traffic. Disabling Defender is not persistent (it seems to switch itself on, etc).
- WolfRazu 4y ago
  If you disable defender using group policy, from my experience that's been disabled consistently for a year no problems. Latest version of Windows 10. Note you need to disable tamper protection and reboot first otherwise it silently reenables itself.
alar44 4y ago
It's standard practice. You don't roll out updates until they are tested.
- videofreedom 4y ago
  Would you like to describe your standard practice? I am interested in implementing this after windows updates have killed our workstations multiple times. Is there a nice description / workflow / tutorial / script / community where I can learn how to do that? I did not find any recommended workflow for this by Microsoft itself, but maybe I was searching for the wrong things - windows updates are generally a bad thing to research anything related for. I expected to find some standard workflow description plus tools on some MS website, but no success. Does that exist? Thank you very much!
  - vetinari 4y ago
    You are looking for WSUS (Windows Server Update Services). If you have Windows Server somewhere, you can add WSUS role to it and use group policies to point your clients to it for updates. Then, in WSUS console, you set up approvals for updates and then the updates will be offered to clients only once you approve them. You can divide the clients into groups and manage the approvals for these groups individually, so you can have a separate testing group.
TurkishPoptart 4y ago
Because somehow it gets worse and less usable each time. Also, planned obsolescence.
marginalia_nu 4y ago
Sometimes Windows installs an upgrade that insists I must connect my user account to a Microsoft account. It will not let me boot the OS if I don't. Only hell if I know what my Microsoft account is. I never use it. I need to use my web browser to find out. But I can't, because I need to set up my Microsoft account first. So I have to use another computer which will let me use it even without a Microsoft account, and then try to figure out my Microsoft account password. Then boot into Windows, let it connect the accounts, go into account options and try to find the hidden dialog to separate them again because hell fucking no I don't want Microsoft to associate my user account with my email address. Being shafted like this every now and then has eroded my trust for Windows' updates.
- josephcsible 4y ago
  > eroded my trust for Windows' updates Remember that security vulnerabilities in Windows are discovered all the time, so it's dangerous to use Windows without installing the updates. If you (rightfully) don't want to install the updates, then you should switch to an OS that actually respects your freedom instead, like Linux.
  - marginalia_nu 4y ago
    I can also just accept the risk. (I already do all my important work on Linux, since like 20 years)

omvtam 4y ago

The nuke-it-from-orbit approach works for me but ymmv: a default-deny firewall for the Windows IP on the default gateway with external squid proxy for Firefox. netstat -on | grep $PID to add rules to allow access per process for things that just have to get through.

me_again 4y ago

Look into WSUS / Windows Update Services

amaccuish 4y ago
He said "without an enterprise install"

mkup 4y ago

Set up SOCKS5 proxy (e.g. github.com/rofl0r/microsocks) on the nearest router and configure router's firewall to drop all outgoing packets whose TTL is near 128 (Windows). Then configure FoxyProxy in Firefox or Chrome to use your SOCKS5 proxy. Windows will think it's offline, browser and other apps which are aware of your proxy will work fine.

RunSet 4y ago

> how to cache windows updates on my local network without an enterprise windows install https://download.wsusoffline.net/ https://download.wsusoffline.net/ will download Windows updates and create an installer for them.

ddlutz 4y ago

I'm surprised "in-home router-level network caching" hasn't become a thing, really. Lets say you have a family of 4, all with iphones that need updating, windows updates, downloading same games from steam, app store, etc. It could be significantly sped up for whole house to download file 1 time instead of 4.

hsbauauvhabzb 4y ago
I believe Microsoft use BitTorrent to distribute updates. It took me a while to realise that many Linux distros use unencrypted http to enable caching, using signature checks to verify file integrity