topic Re: allowing MS product activation and denying web access in General Topics

allowing MS product activation and denying web access

kjh — Mon, 17 Dec 2012 01:12:53 GMT

I have a network that I want to allow MS product activation to work but web browsing and other internet activity to be denied.

I have two main security policies that apply just to this network although DNS and ntp is also allowed:

The first one is an application filter that allows all applications you get when you click on "software-updates". And the port set is "application default".

The second rule is a deny all.

As I see it this should allow ms-product-activation but it doesn't. Do I need a separate rule with just ms-product-activation. Do I need to add any other applications to the rule to make it work? For instance, say web-browsing and https and ports 80 and 443. This would unfortunately allow web-browsing which I want to deny.

Re: allowing MS product activation and denying web access

dieter_b — Tue, 18 Dec 2012 07:30:21 GMT

In my experience, PA is not able to recognize MS product activation traffic reliably.

Sometimes it is recognized correctly, but most of the time PA recognizes it as ms-update or even web-browsing.

Doesn't help either that MS is secretive about the whole activation process, would be a lot easier if it were one type of traffic (for all MS products) and/or to fixed known destinations (subnets).

Maybe you're better of with a local KMS...

Re: allowing MS product activation and denying web access

mikand — Tue, 18 Dec 2012 09:33:49 GMT

There is a list available at:

http://support.microsoft.com/kb/921471

one url not mentioned there seems to be:

wpa.one.microsoft.com:80

dunno if the above wpa url is still valid as part of the activation or not.

I guess the best would be if you could setup a local auth server for this and then just allow this particular server to reach microsoft's domains.

Re: allowing MS product activation and denying web access

GoranBerglund — Mon, 26 Feb 2024 14:46:35 GMT

Hi. We used the application ms-product-activation with good results. ( so no ssl only ms-product-activation )