Windows Update Connections at Risk: Microsoft Urges Organizations to Check Firewalls and Proxies

Microsoft is reminding organizations to review their firewall and proxy configurations to ensure Windows devices can connect reliably to the Windows Update service. Incorrect network configurations could prevent devices from reaching trusted Windows Update endpoints, potentially leaving systems without important security updates.

The warning is particularly relevant for organizations that use strict firewall rules, proxy servers, TLS inspection, or other forms of encrypted traffic interception. While these security controls are designed to protect corporate networks, improperly configured rules can unintentionally interfere with the mechanisms Windows uses to securely communicate with Microsoft’s update infrastructure.

Microsoft published detailed guidance in May 2026 to help IT administrators diagnose these connection problems. The company is now emphasizing that organizations experiencing update connectivity issues may continue to encounter them until the recommended configuration changes are implemented.

Why Windows Update connectivity can fail

At the heart of the issue is Microsoft’s security model for Windows Update.

Windows Update is designed not to trust servers that do not have TLS certificates issued by an appropriate Windows Update trust anchor. This approach is intended to prevent malicious or unauthorized servers from impersonating legitimate update infrastructure.

Transport Layer Security, commonly known as TLS, helps protect communications between a device and the services it connects to. It provides encryption and helps verify that the remote server is authentic.

However, corporate networks sometimes use security appliances that inspect encrypted traffic. A firewall or proxy may terminate a TLS connection, inspect its contents, and then establish another connection to the destination server. Although this can be a legitimate enterprise security practice, it can also create problems for applications that expect a direct and properly trusted TLS connection.

Windows Update is one such case where network security controls need to be configured carefully.

Microsoft’s guidance therefore focuses on ensuring that firewalls and proxies allow the necessary Windows Update traffic to reach the correct Microsoft endpoints without breaking the expected certificate and TLS trust relationships.

May guidance remains important

Microsoft originally published its detailed troubleshooting guidance in May 2026. The documentation was created to help IT professionals investigate connection problems associated with firewall and proxy configurations.

The important point for administrators is that the guidance is not simply informational. Organizations that are still experiencing Windows Update connection failures may need to make configuration changes based on the recommendations.

In other words, waiting for the problem to disappear may not solve the underlying issue.

If a firewall or proxy is blocking the required endpoints, devices can continue to experience Windows Update failures until administrators correct the network configuration.

Check the Windows Update audit log

For organizations investigating the issue, Microsoft recommends starting with the Windows Update audit log.

Administrators can use Microsoft’s PowerShell tooling to generate and inspect Windows Update logs. The Windows Update log documentation provides the relevant command and additional information for troubleshooting.

Microsoft’s detailed firewall and proxy guidance also identifies a recommended PowerShell command and four error codes that can help confirm whether the connectivity problem is related to the configuration described in the advisory.

This gives IT teams a practical starting point rather than requiring them to immediately make broad changes to network security policies.

The recommended approach is to first establish whether the affected devices are actually experiencing the relevant Windows Update connectivity problem. Once the evidence is confirmed, administrators can then review their firewall and proxy rules.

Wildcard FQDN rules are especially important

One of the key recommendations is to make sure that all required DNS hosts and subdomains represented by wildcard fully qualified domain names, or FQDNs, are trusted and accessible.

This is an important distinction because allowing only a single hostname may not be sufficient.

For example, Microsoft uses the wildcard hostname:

*.update.microsoft.com

That wildcard can represent multiple hosts and subdomains, including:

update.microsoft.com
sls.update.microsoft.com
tas02.sls.update.microsoft.com

If an organization’s firewall or proxy configuration allows one endpoint but blocks another required subdomain, Windows Update connectivity can still fail.

This is why administrators should carefully review how their network security products interpret wildcard FQDN rules.

A configuration that appears to allow Windows Update traffic at first glance may still prevent access to individual subdomains required during the update process.

TLS inspection can create another problem

Organizations using TLS interception should pay particular attention to Microsoft’s warning.

TLS inspection is commonly deployed to provide additional visibility into encrypted network traffic. A security appliance effectively sits between the client and the destination, decrypting and inspecting traffic before establishing its own encrypted connection.

For many applications, this works without a noticeable problem. However, applications that rely on specific certificate trust relationships can behave differently.

Windows Update is designed around trusted Microsoft update infrastructure and certificate validation. If a proxy or security appliance alters the expected TLS connection or presents a certificate that isn’t trusted in the required way, the Windows Update client may reject the connection.

That means simply adding a generic “allow Windows Update” rule may not always resolve the problem.

IT administrators should instead review whether their security infrastructure is intercepting the relevant TLS connections and whether necessary Windows Update DNS endpoints are being passed through correctly.

Security updates are the biggest concern

The issue goes beyond failed feature updates or inconvenient update notifications.

Microsoft warns that devices unable to reach the Windows Update service can stop receiving security updates.

For businesses, this creates a potentially significant security and compliance concern.

Security updates are a fundamental part of maintaining Windows environments. When devices fall behind on patches, known vulnerabilities may remain unaddressed for longer periods. In a corporate environment with hundreds or thousands of endpoints, a network configuration problem affecting update connectivity can therefore become an organization-wide security issue.

Administrators should treat persistent Windows Update connection failures as more than a routine technical support problem.

A device that cannot communicate with Microsoft’s update infrastructure may eventually become an unpatched device, increasing exposure to vulnerabilities that could otherwise have been addressed through Microsoft’s regular security servicing process.

WSUS environments are different

There is an important exception for organizations that use Windows Server Update Services, or WSUS, to manage updates internally.

Microsoft says that the specific Windows Update endpoint exceptions discussed in this guidance aren’t necessary for devices that connect to an IT-managed WSUS server.

That distinction is important because enterprise update architectures can vary considerably.

Organizations using Microsoft’s cloud-based Windows Update service should review the relevant firewall and proxy requirements. Organizations routing their managed devices through an internal WSUS infrastructure should instead ensure that their WSUS environment and its own network connectivity are properly configured.

Administrators should therefore identify which update architecture their devices are actually using before making changes to firewall policies.

What IT administrators should do now

Organizations experiencing Windows Update connection problems should take a structured approach.

First, check affected devices and review the Windows Update audit logs for evidence of connectivity failures. Microsoft’s troubleshooting documentation can help administrators identify the relevant errors.

Next, review firewall and proxy configurations. Pay particular attention to whether TLS connections are being intercepted and whether required Windows Update DNS hosts and subdomains are accessible.

Administrators should also check wildcard FQDN configurations. If a rule is intended to permit *.update.microsoft.com, verify that the organization’s firewall or proxy solution actually handles the wildcard as expected and doesn’t inadvertently exclude required subdomains.

If endpoints are missing from the allowlist, network administrators should update their configurations accordingly.

Microsoft’s detailed guidance on configuring firewalls and proxies for smooth Windows updates provides the recommended troubleshooting steps and endpoint information.

A small configuration issue can become a major security problem

The broader lesson from Microsoft’s warning is that network security and endpoint management cannot always be treated as completely separate systems.

A firewall rule that improves network control can unintentionally interfere with operating-system servicing. Likewise, TLS inspection that works correctly for most applications can cause failures for services with stricter certificate trust requirements.

For organizations, maintaining a reliable Windows Update process means ensuring that security infrastructure allows legitimate update traffic to function as designed.

This is particularly important as businesses increasingly rely on centralized firewall policies, secure web gateways, cloud proxies and encrypted traffic inspection.

Microsoft’s recommendation is ultimately straightforward: diagnose the problem, verify the necessary Windows Update endpoints, and update firewall and proxy configurations where required.

Organizations should not ignore persistent Windows Update connectivity failures. If devices cannot reach the service, they could eventually miss security updates turning what initially looks like a networking configuration problem into a much more serious security and compliance risk.