topic Re: Block microsoft updates by blocking ms-update app ? in General Topics

Block microsoft updates by blocking ms-update app ?

dermotmcdonald — Tue, 08 Dec 2020 15:11:32 GMT

Hello all,

What is the best way to block microsoft updates on the PA ?

I have seen the url filtering suggestion but was wondering could we just drop via ms-update app ?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbvCAC

Tks

Dermot

Re: Block microsoft updates by blocking ms-update app ?

reaper — Tue, 08 Dec 2020 15:33:49 GMT

A lot of ms-update also uses regular ssl.

You may be able to catch a lot by simply blocking ms-update if you also have ssl decryption enabled. If you don't use ssl decryption for all your outbound traffic, you'll need the url categories to catch the connections that use ssl

Re: Block microsoft updates by blocking ms-update app ?

dermotmcdonald — Wed, 09 Dec 2020 08:48:08 GMT

That makes sense, tks