What Firewall Rules Will Allow Windows Update and ONLY Windows Update to Work For Windows 8.1? If that is not possible please provide the minimum rules necessary and the names of the additional program(s)/service(s) that must be granted access.

  • Are you trying to prevent loss of bandwidth from other apps doing their updates, i.e., prevent them from updating at all? If so, do you still want those apps to update, but at a different time? Or, do you want them to update from a different source? If any of these are true, seems to me that using firewalls might not be the best way. Are you also concerned with the system CPU/RAM impact of all these updaters running? – DaaBoss Oct 31 '15 at 14:36
  • Sorry for the confusion. I am blocking all traffic except what I specifically allow and need the rules to allow windows update to function. In 8.1 it requires more than just allowing the update service outbound traffic. – Ron Oct 31 '15 at 16:19
  • Narrowed it down a bit. I had a rule allowing update outbound traffic on TCP ports 80 and 443 but that did not work. I added a rule allowing all programs and services outbound traffic on TCP 80 and it works. – Ron Nov 1 '15 at 13:09
  • Last comment was incorrect. Narrowed it to: Allow all programs and services tcp port 80 outbound and all outbound traffic for the following services - appinfo, bits, dsmsvc, gpsvc, iphpsvc, lanmanserver, profsvc, schedule, sens, shellhwdetection, system events broker, themes, winmgmt, wuauserv. – Ron Nov 1 '15 at 18:31

I debugged this problem for hours. In the end, to get Windows Update through Windows firewall you must allow svchost. You cannot narrow the protocol, scope, application packages or services.

So I have 0 inbound firewall rules, and 3 outbound firewall rules two of which are active at any point in time. Those rules are:

  1. Allow svchost

  2. Block svchost

  3. WFC - Core Networking - Dynamic Host Configuration Protocol (DHCP-out)

AND Other applications that require internet (i.e., your web browser)

To connect to the internet, I must turn on 1 and 3. After I can turn off 1 and 3 and turn on 2. If my internet is on, and I want to use windows update, I then disable 2 and enable 1. That means after I have connected to the internet and don't plan on using windows update that the only weakness in my firewall is my browser assuming I haven't added any other exceptions.

Windows PowerUser,


So far it doesn't look like windows firewall actually performs the functions it offers, blocking individual services under the umbrella of the svchost. Microsoft releases windows updates every second Tuesday of each month give or take 24 hours or so. You could create a script that automatically enables svchost out each month, and one for every day for defender updates; (for 5-10 minutes) or do it manually.

Or, you could for example block everything, enable packet logging, monitor the ip addresses and ports for every windows update server connection, then only allow svchost out for those specific ip addresses, this will narrow it down to only allow windows update. If you use cidr format replacing the last 3 digits with .1/24, you will be able to reach every ips on that subnet if they change over time. After hammering this out enough, should you notice other ip's pop up outside that scope, you will over time know its not windows update. I am not sure how one can detect exactly what program/service is operating under the svchost umbrella other than triggering it manually.

For Windows Updates, use Group Policy "Delivery Optimization" Download Mode, set to 99, (meaning no P2P or cloud services, just microsofts servers alone; so you don't get 1,000,000,000 different ips) Then you must create a blacklist for each ip that comes up through svchost that does not involve windows update.

Remote addresses:,,,,,,,,,,,,,

This worked for me. [Using WFC a Windows Defender Firewall Front End GUI]

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.