Windows 10: Scan changes and certificates add security for Windows 10 using WSUS

Brink · Jan 13, 2021

To help prevent man-in-the-middle attacks, the January 2021 cumulative update for Windows 10 further improves security for devices that scan Windows Server Update Services (WSUS) for updates. These improvements build on the security changes for Windows devices scanning WSUS we introduced on September 8, 2020 and can be combined with certificate pinning for greater security. I'll now explain these changes in more detail.

Scanning behavior changes

For devices scanning HTTPS-configured WSUS servers

For those using proxies, we have switched to using system proxy first, rather than user proxy. This ensures that we are first trying the most secure proxy path if a proxy is needed. We will no longer fall back to user proxy for scanning WSUS servers if the policy to allow user proxy as a fallback method is not enabled. This ensures that admins must consciously enable a less secure method for scanning as doing so will put them at higher risk of attack.

If you need to allow devices to scan utilizing user proxy as a fallback method, you can do so by configuring one of the following policies:

Group Policy GPEDIT > Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify intranet Microsoft update service location > Select the proxy behavior for Windows Update client for detecting updates > Allow user proxy to be used as fallback if detection using system proxy fails Configuration Service Provider (CSP) policy Set Update/SetProxyBehaviorForUpdateDetection to 1 - Allow user proxy to be used as a fallback if detection using system proxy fails Configuration Manager Configure the new Allow User Proxy for software update scans setting to Yes to allow user proxy in Microsoft Endpoint Configuration Manager, version 2010 and later.
To further increase security, we have added the capability for customers to pin certificates (cert-pinning) and not allow scans, even with system proxy, if cert-pinning fails. This provides the highest level of security for devices but will require more overhead for the admin in order to ensure that certificate stores are properly configured.

Note: This capability is only available to those who have secured their WSUS servers with TLS protocol/HTTPS.

To enable cert-pinning, simply add the correct certificates to the new WSUS certificate store. Devices will then automatically begin enforcing cert-pinning when scanning your WSUS server. If no certificates are in your WSUS certificate store, cert-pinning will not be enforced. Further, if you do not wish devices to have this extra layer of security upon scan, you can ensure that cert-pinning is not enforced by configuring one of the following policies:

Group Policy GPEDIT > Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify intranet Microsoft update service location > Do not enforce TLS certificate pinning for Windows Update client for detecting updates Configuration Service Provider (CSP) policy Set Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection to 1 - Do not enforce certificate pinning

For devices scanning HTTP-configured WSUS servers

For those devices scanning HTTP-configured WSUS servers, there have been no additional changes since those we introduced with the September 2020 cumulative update.

For online scans

The order of proxy selection for online scans, if a proxy is needed, has changed:

Old behavior:

Scan with user proxy.

If user proxy fails, attempt scan with system proxy.

New behavior as of the January 2021 cumulative update:

Scan with system proxy.

If system proxy fails, attempt scan with user proxy.

This change ensures that we first try the most secure proxy path if a proxy is needed.

Note: For user-driven, interactive scenarios, we always use the user proxy, if one is available, regardless of policy configuration.

Next steps

To prevent scan failures and ensure the highest level of security, please follow these recommendations:

Donât enable user proxy.

If you require user proxy, enable user proxy via âSelect the proxy behavior for Windows Update client for detecting updatesâ to ensure that devices do not encounter scan issues.
Note: While this will allow you to fallback to use user proxy for scans against your WSUS server, you should be leveraging this process only as a stop gap to continue getting updates while transitioning to system proxy or no proxy.

Secure your WSUS server with TLS protocol/HTTP. This is pivotal to maintain the chain of trust and prevent attacks on your client computers, see Recommendations for greater security in the previous Changes to improve security for Windows devices scanning WSUS blog.

When scanning against a TLS/HTTPS-configured WSUS server, leverage cert-pinning to get the highest level of security and keep your devices protected. (Reminder that this requires populating the deviceâs certificate store.)

Click to expand...

Source: https://techcommunity.microsoft.com/...s/ba-p/2053668

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

:)

Arun B J · Jan 13, 2021

Security Certificate Problems with Windows 10

Hi,

Thank you for posting your query in Microsoft Community.

Where exactly are you getting Security Certificate Warnings?

Are you using Internet Explorer?

Since when are you facing this issue?

I suggest you to send us Screen shot of the image (Security Certificate Warnings).

Follow the steps given in the link below to provide the screenshot.

How to include a screenshot in your post

How to include a screenshot in your post

Reply with necessary information and I’ll be happy to help you further.

Thanks and Regards

Mindweaver · Jan 13, 2021

Certification Questions....

I would say the A+ certification should be your first step. Then I would go for the Server 2016 over Windows 10. but if they are paying for it why not both? I like the CompTIA A+, CompTIA Server+, and CompTIA Security+ certs, maybe network+ as well.

EDIT: It just depends on what you want to do in IT.

Brink · Jan 13, 2021

Improving security for Windows 10 devices receiving updates via WSUS

With the September 2020 cumulative update for Windows 10, we introduced changes that help improve the security of devices that scan Windows Server Update Services (WSUS) for their updates. This post will describe those changes and offer basic recommendations to help you better secure the devices in you organization.

Secure by default

First, beginning with the September 2020 cumulative update, HTTP-based intranet servers will be secure by default. To ensure that your devices remain inherently secure, we are no longer allowing HTTP-based intranet servers to leverage user proxy by default to detect updates. If you have a WSUS environment not secured with TLS protocol/HTTPS and a device requires a proxy in order to successfully connect to intranet WSUS Servers—and that proxy is only configured for users (not devices)—then your software update scans against WSUS will start to fail after your device successfully takes the September 2020 cumulative update.

Recommendations for greater security

To help ensure the security of your WSUS infrastructure, Microsoft recommends using the TLS/SSL protocol between your devices and your WSUS servers. The Microsoft Update system (including WSUS) relies on two types of content: update payloads and update metadata. Update payloads are the data files that contain the software update components that make up the update. Update metadata is all the information that the Microsoft Update system needs to know about the updates, including which updates are available, which devices each update can be applied to, and where to retrieve the payloads for each update. Both types of content are crucial and they both need to be protected to help keep your computers secure and up to date.

Update payloads are protected against modification by multiple means, including digital signature checks and cryptographic hash verifications. HTTPS provides a proper chain of custody which the client uses to prove the data is trusted.

When a device receives updates directly from Microsoft Update, that device receives update metadata directly from Microsoft servers. This metadata is always transmitted via HTTPS to prevent tampering. When you use WSUS or Configuration Manager to manage your organization's updates, the update metadata travels from Microsoft servers to your devices via a chain of connections. Each one of these connections needs to be protected against malicious attacks.

Your WSUS server connects with Windows Update servers and receives update metadata. This connection always uses HTTPS, and the HTTPS security features guard the metadata against tampering. If you have multiple WSUS servers arranged in a hierarchy, the downstream servers receive metadata from the upstream servers. Here, you have a choice: you can use HTTP or HTTPS for these metadata connections. Using HTTP; however, can be very dangerous as it breaks the chain of trust and can leave you vulnerable to attack. Using HTTPS enables the WSUS server to prove that it trusts the metadata it receives from the upstream WSUS server.

In order to maintain the chain of trust and prevent attacks on your client computers, you must ensure that all metadata connections within your organizations – the connections between upstream and downstream WSUS servers, and the connections between the WSUS servers and your client computers – are defended against attacks. To do so, we highly recommend that you configure your WSUS network to protect these connections using HTTPS. To learn more, see Michael Cureton’s post Security best practices for Windows Server Update Services (WSUS).

Even with HTTPS configured, it is still very important that you utilize a system-based proxy rather than a user-based proxy if a proxy is needed. When using a user-based proxy, a user, even one without elevated privileges, could intercept and manipulate the data being exchanged between the update client and the update server.

Recommendations for those who absolutely need user proxy

If you do need to leverage a user-based proxy to detect updates while using an HTTP-based intranet server, despite the vulnerabilities it presents, make sure to configure the proxy behavior to "Allow user proxy to be used as a fallback if detection using system proxy fails."

Group Policy path: Windows Components>Windows Update>Specify intranet Microsoft update service location

Configuration Service Provider path: Update/ SetProxyBehaviorForUpdateDetection

Next steps

If you are an IT administrator who currently manages an HTTP-configured WSUS environment and relies on user-based proxy for client scans, please consider taking one of the following actions as soon as possible. If none of these actions are taken your devices will stop successfully scanning for software updates after the September 2020 security update.

Options to ensure that devices in your environment can continue to successfully scan for updates:

Secure your WSUS environment with TLS/SSL protocol (configure servers with HTTPS).

Set up system-based proxy for detecting updates if needed.

Click to expand...

Source: https://techcommunity.microsoft.com/...s/ba-p/1645547

Windows 10: Scan changes and certificates add security for Windows 10 using WSUS

Scan changes and certificates add security for Windows 10 using WSUS

Scan changes and certificates add security for Windows 10 using WSUS

Scan changes and certificates add security for Windows 10 using WSUS

Scan changes and certificates add security for Windows 10 using WSUS - Similar Threads - Scan changes certificates

Windows 10 to Windows 11 upgrade using Wsus

Security certificate

Security certificate

WSUS Dual Scan - HELP

WSUS Dual Scan - HELP

WSUS Dual Scan - HELP

Certificate security

security certificate

Security Certificate