Need to blacklist windows updates on 8e6

[juventus]

I work in a school's IT department. Recently windows automatic updates have been blowing up our allotted bandwidth. We have decided to blacklist/block windows updates on a mass scale by simply adding it to our blacklist in our 8e6 filter. The problem we have is that we're not sure what ip/url to use to block the updates. Sure, we could go computer to computer turning the automatic updates off but when you have over 500 computers, that's kind of time consuming. Thanks!

[AJT1]

Why don't you introduce something like WSUS to keep your computers up to date?

 

It would be far safer than not updating your pc's at all.

[powdarrmonkey]

+1 for WSUS. Not permitting updates isn't really a long-term solution.

[timbo343]

Or turn them off in group policy

[Gatt]

Another for WSUS...

 

Also means your PCs update quicker too..

[elsiegee40]

Or turn them off in group policy

 

Why don't you introduce something like WSUS to keep your computers up to date?

 

It would be far safer than not updating your pc's at all.

 

Do both! Far and away the best thing to do

[tom_newton]

You may be able to lower the bandwidth allocated to windows updates if you are talking non-domain PCs.

Turning em off would be, as others have said, mental

[juventus]

We have the updates taken care of...they'll still get their updates through another program we use. But I need to know what either the IP or URL is where the updates come from. Thanks for your help all!

[somabc]

Yeah right this is a joke isn't? To save costs on Power I am going to randomly turn 20% of my PC's off during the day, think of the money I'll save!

 

You are going to turn off Windows Updates to save bandwidth. How much bandwidth do you think you will save when your machines are pumping out spam?

 

You have 500 PC's downloading each update, why not have 1? Use WSUS you download each update ONCE then deploy it to each machine. It is the most efficient method and lets you use reporting to see which updates are installed on which machines.

Edited November 14, 2008 by somabc

[juventus]

Oh yeah, we're running Novell 4.91 / XP Pro.

[juventus]

We have a program which does what WSUS does...all I'm asking is if Automatic Updates has an IP address. Our computers will STILL be getting the updates just via another channel.

[somabc]

Oh yeah, we're running Novell 4.91 / XP Pro.

 

There's your problem!

[juventus]

Can anyone actually answer my question or do you all just want to hack at me for asking this question? If there's no answer, fine, tell me.

[somabc]

ok ok, its just you should have mentioned novell in your first post.

 

you can try blocking a248.e.akamai.net

 

requests for Microsoft Corporation no longer resolve to machines on Microsoft’s own network, but instead are handled by the Akamai caching system and the actual Akamai server you connect to will differ according to your location on the internet and may vary from request to request.

 

So difficult to block.

 

telnet update.microsoft.com http
Trying 65.55.184.29...
Connected to update.microsoft.com.nsatc.net.

 

update.microsoft.com.           IN      A

ANSWER SECTION:
update.microsoft.com.   3600    IN      CNAME
update.microsoft.com.nsatc.net.
update.microsoft.com.nsatc.net. 300     IN      CNAME
www.update.microsoft.com.
www.update.microsoft.com. 804     IN      CNAME
www.update.microsoft.com.nsatc.net.
www.update.microsoft.com.nsatc.net. 55      IN      A       65.55.200.157

 

nsatc.net

Edited November 14, 2008 by somabc

[juventus]

I didn't even think to include it since I wasn't asking about my network...I was only asking what the IP/URL was for automatic updates. Thanks for the answer.

[tom_newton]

Don't block akmai - it will break other things. Windows update is pretty easy to bust if you block update.microsoft.com and a couple of others. Check your filter logs whilst they are updating - if you are still having trouble i can check our whitelists monday.

[somabc]

Don't block akmai - it will break other things. Windows update is pretty easy to bust if you block update.microsoft.com and a couple of others. Check your filter logs whilst they are updating - if you are still having trouble i can check our whitelists monday.

 

That's true akamai is used by lots of of other sites to deliver data.

[Hightower]

I know you wanted an IP address and it appears you got that (in the end). But as mentioned earlier in the topic - could you not use GPO to disable automatic updates? Like you say, you have a method of updating the machines so surely this would be the safest way?