6

I recently uninstalled ZoneAlarm and have decided to use Windows Firewall as my firewall as ZoneAlarm was causing me grief when I was syncing my iphone.

Anyway, I've noticed just then that Windows Firewall seems to block my Windows updates.

Whenever I have the firewall on, I get a 8024402C error when I try to update, and it seems to update fine when I don't have the firewall on.

there is a help page for this error http://answers.microsoft.com/en-us/windows/forum/windows_other-windows_update/8024402c-error/760ba53f-2cb1-48be-a77f-61bf445fddde

but it seems to assume that the firewall I have is third party, I'm not sure how to fix it if Windows Firewall itself is the firewall that is blocking the automatic updates.

Improve this question
3
  • Actually, I should have noticed the tag...My fault, just missed it.
    – KCotreau
    Jul 20, 2011 at 16:30
  • nah actually i added in the tag after u noted me on it
    – RoboShop
    Jul 21, 2011 at 1:26
  • It is important to note, that firewall rules are applied from top to bottom. The first rule has the highest priority. This means if your first rule blocks all outgoing traffic to 0.0.0.0 you won't ever get a connection to the "outside", even if your next Rule explicit allows all outgoing traffic to 0.0.0.0.
    – Nordlys Jeger
    Aug 18, 2018 at 1:23

6 Answers 6

Reset to default
4

I've found solution.

I found it here.

Essentially I added a new incoming rule which allowed all connections coming from c:\windows\System32\svchost.exe.

I wonder why my default settings didn't already have this? Anyway it worked!

Improve this answer
3
  • When adding this rule on Windows 8, Windows Firewall warns me that this rule would not work as expected. Do you know what could it mean?
    – utapyngo
    Aug 5, 2013 at 9:12
  • Windows Update is calling a remote service. So the rule must be outbound, not inbound.
    – SandRock
    Mar 27, 2017 at 16:47
  • 1
    Allowing svchost.exe will also allow traffic for all the other services on the machine. That might not be what you want.
    – SandRock
    Mar 1, 2022 at 13:20
3

In Win 8 Go to Control Panel>Firewall>Advanced Settings.

Then click Action>Export policy to make a copy of your current policy in case you want to restore it.

Then click Action>New Rule>Custom>Next in the Program step of New Outbound Rule Wizard under the Service heading select Customize>Apply to this service>Windows Update>OK

Optional: Program: select this program path and select the program c:\windows\System32\svchost.exe press ok

Optional: Protocol and Ports: specify tcp port 443

Allow this connection; select your profile or leave as is (it should be explained in the wizard pretty well); give it a name.

Finish

Improve this answer
2
  • It works like a charm, even on Windows 7
    – Marco Demaio
    Nov 21, 2016 at 14:17
  • Is it important to specify the svchost.exe program? I'm afraid not specifying it would allow any app to make a remote call. When I specify it, there is a strange message: "Windows Services have been restricted with rules that allow expected behavior only. [...] Rules that specify host processes might not work as expected [...]."
    – SandRock
    Mar 27, 2017 at 16:51
1

Go to Control Panel>Firewall>Advanced Settings. Then click Action>Export policy to make a copy of your current policy in case you want to restore it. Then click Action>Restore Default Policy.

If it really is just the Firewall, this should allow you to use Windows Update.

enter image description here

Improve this answer
1
  • I have tried to restore to default, however, the same problem still exists. Is this then not a firewall issue? I don't understand how than stopping the firewall will cause it to work.
    – RoboShop
    Jul 21, 2011 at 1:27
0

Open Command Prompt as administrator and type the following commands, one by one (press ENTER after each command):

 - netsh winhttp reset proxy 
 - net stop wuauserv 
 - net start wuauserv

Try to install the updates again.

Source: http://support.microsoft.com/kb/900936

Improve this answer
2
  • 3
    He already said Windows Update works if he turns off the firewall ("it seems to update fine when I don't have the firewall on"), so no need to reset any of this.
    – KCotreau
    Jul 20, 2011 at 16:41
  • You're right...
    – Nicu Zecheru
    Jul 20, 2011 at 17:36
0

Here is how to change firewall settings in Windows 7, you can watch the video to learn the steps ;

Allow a program to communicate through Windows Firewall

By default, most programs are blocked by Windows Firewall to help make your computer more secure. To work properly, some programs might require you to allow them to communicate through the firewall.

Watch this video to learn how to allow a program to communicate through Windows Firewall (1:12)

Open Windows Firewall by clicking the Start button Picture of the Start button, and then clicking Control Panel. In the search box, type firewall, and then click Windows Firewall.

enter image description here

In the left pane, click Allow a program or feature through Windows Firewall.

Click Change settings. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

Select the check box next to the program you want to allow, select the network locations you want to allow communication on, and then click OK.

Warning Before allowing a program through the firewall, make sure you understand the risks involved. For more information, see What are the risks of allowing programs through a firewall?

http://windows.microsoft.com/en-US/windows7/Allow-a-program-to-communicate-through-Windows-Firewall

Improve this answer
2
  • 2
    The key is "what program?", or what ports? It is not listed there. It must come under the umbrella of some more esoteric listing.
    – KCotreau
    Jul 20, 2011 at 16:40
  • 2
    @KCotreau : yeah there is no like "Windows Update" program on there for me to choose.
    – RoboShop
    Jul 21, 2011 at 1:30
0

In Windows 8 and 10, allowing the Windows Update service through the firewall is not enough. It appears to be because it uses a thread pool, but the security context is not correctly set on those threads, so they are not recognised by the firewall as being from Windows Update. (Link)

The solution that works for me was partially suggested by Uwe Bubeck on the Technet forums (Link):

  1. Create a link to svchost.exe, for example mysvchost.exe, by using the command mklink /H mysvchost.exe svchost.exe. To do this, you will need permissions on svchost.exe.
  2. Allow mysvchost through the firewall.
  3. Change the ImagePath for the Windows Update service in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv from svchost to mysvchost.
  4. Restart Windows Update to apply the change.
    You can now find updates, but they will not download.
  5. Add an exception for TCP/80 on svchost.exe (i.e. all services). Updates can now be downloaded.

Before allowing all services TCP port 80, I tried adding an exception for TrustedInstaller, moving BITS (background transfer) to mysvchost, and some other services suggested by others such as cryptographic services. In the end, I couldn't find which service is responsible for downloading the updates, so I had to add an exception for all services. Downloading updates now works. If someone figures out the minimal set of changes, rather than a large whitelist for all services, please edit this answer (and maybe also post it to the technet threads).

Improve this answer
2
  • Somebody mind explaining why this was downvoted? Is it incorrect or does it not answer the question?
    – Luc
    Aug 16, 2018 at 19:19
  • I upvote because I don't know why the downvote. I never understand why someone downvote but don't tell the reason. How to learn if you don't know the reason?
    – Álvaro García
    Jun 10, 2022 at 8:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .