topic MS Windows Store Download Troubles in General Topics

MS Windows Store Download Troubles

w.naderer — Wed, 08 Jul 2020 10:47:02 GMT

Dear Community,

I'm looking for the best practice to allow user to download apps over the ms windows store. But sometimes the download is successfully and sometimes i get an error.

Why?

No Decryption on which ip or url?

Which Apps I need to allow - ms-store and others?

I hope you can help me

Wolfgang

Re: MS Windows Store Download Troubles

shawnhafen — Wed, 08 Jul 2020 19:15:08 GMT

If this is only happening over the VPN then this is a known issue and is also a Microsoft issue that impacts any and all/other VPN clients. This is fixable with some GPO changes, we made these changes (did not require a reboot) and everything worked with the app store 100% of the time immediately.

I do not have the original post link that I found the fix on but I *think* this is the same fix here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNL5CAO

Re: MS Windows Store Download Troubles

BPry — Wed, 08 Jul 2020 19:33:57 GMT

@w.naderer,

If this is not over the VPN and you are not doing decryption all of this traffic is going to be primarily identified as ms-store, which works with or without encryption.

If this is while you are connected to GlobalProtect then @shawnhafen is 100% correct and you'll want to make the Group Policy changes described in the KB article so that this starts functioning correctly again.

Re: MS Windows Store Download Troubles

w.naderer — Thu, 09 Jul 2020 05:06:34 GMT

Hi BPry and shawnhafen,

Thanks but thats not my question/solution. I also had Troubles with Downloads/Updates over normal lan. Sometime I can download apps.

I think the problems are the palo settings - no decryption, apps - but which one?

I hope you understand my correct and you have other ideas?!

Thx

Wuff

Re: MS Windows Store Download Troubles

BPry — Thu, 09 Jul 2020 14:20:06 GMT

@w.naderer,

If it's happening even on the LAN connection it's more than likely a security rulebase problem.

First and foremost make sure that you have logging enabled on your interzone-default policy, or are otherwise capturing denied traffic to the untrust (internet) interface. By default you won't have logs for this, and if you aren't allowing required traffic you may not have the associated threat logs to look at. Store traffic should be getting identified as ms-store and ssl.

You mention no decryption but I'm unsure exactly what you mean on this. Are you not performing decryption on traffic at all, or are you wondering what URLs should be set to not decrypt? By default, the firewall already has most of what you will need present in the ssl decryption exclusions automatically.

The following URLs can also be excluded for decryption to prevent any store related issues:

login.live.com
account.live.com
clientconfig.passport.net
wustat.windows.com
*.windowsupdate.com
*.wns.windows.com
*.microsoft.com
*.s-microsoft.com
msftconnecttest.com

Re: MS Windows Store Download Troubles

w.naderer — Fri, 10 Jul 2020 05:33:48 GMT

Hi BPry,

Thanks for your Response 🙂

I allowed app ms-update and ms-store. I filled in under ssl-decryption exclussion following urls:

I think it works..

Thank you

Wolfgang

Re: MS Windows Store Download Troubles

Ebernardo — Mon, 10 Nov 2025 16:55:49 GMT

Thank you, we've been having issues with the ms-store blocking downloads and adding these additional URLs to the no-decrypt list finally fixed the issue!