Windows downloading unknown file

[Jobos]

I see our Sophos XG firewall is blocking many attempts from different machines to download a .cab file from Microsoft. Any idea what the file is for? The machines are running a mix of Win10 1803 and 1903.

 

http://adl.windows.com/appraiseradl/2019_12_05_03_05_AMD64.cab

[Duke5A]

Some sort of telemetry gathering. Looks at device drivers and installed apps. If I had to guess probably something that precludes a feature update.

[Passat1983ICTech]

just had a look might be to do with sage have you got a like a card payment for a login card for this

[mavhc]

The scheduled task is named "Windows Compatibility Appraiser" and can be found in the Task Scheduler Library under Microsoft > Windows > Application Experience. Changes are invoked via the nightly scheduled task. It attempts to run around 3:00AM every day. If the system is powered off at that time, the task will run when the system is turned on.

 

https://docs.microsoft.com/en-us/windows/deployment/update/windows-analytics-get-started

 

Surprised Sophos hasn't just whitelisted *.microsoft.com

[Jobos]

Thanks all, but should I allow the .cab through as not sure I need MS collecting usage data not to mention any slowdown of the machine while it scans.

@mavhc *.microsoft.com is white listed but not for downloading system files.

[mavhc]

That's what SSDs and process priorities are for

 

You can sign up for free for update compliance, device health, and compatibility manager, and see the results, it's quite helpful, showed me that a room of desktops had a dodgy ethernet driver