Windows 10: WSUS Dual Scan - HELP

KenUJ · Mar 15, 2024

Just trying to see if anyone can help me with this issue. I have set up a dual scan in our system but I keep getting 0x8024002e when trying to manually look for the update.When I change the registry value of “DisableWindowsUpdateAccess” manually to 0, then everything works fine. I can download updates directly from the Microsoft server and get the updates from our wsus server.In the GP, under Windows update settings I have the “RemoveWindowsUpdateAccess” set to “disabled”, in theory, that setting should change the “DisableWindowsUpdateAccess” to 0 in the registry but for some reason, it's not

:)

exodusprime1337 · Mar 15, 2024

windows xp installation and dual core am

could someone please list the steps they follow to install windows with a dual core processor and windows xp service pack to. I'm reletively new to amd dual core and i feel i'm missing a step. All help will be appreciated. thanx

Brink · Mar 15, 2024

Scan changes and certificates add security for Windows 10 using WSUS

To help prevent man-in-the-middle attacks, the January 2021 cumulative update for Windows 10 further improves security for devices that scan Windows Server Update Services (WSUS) for updates. These improvements build on the security changes for Windows devices scanning WSUS we introduced on September 8, 2020 and can be combined with certificate pinning for greater security. I'll now explain these changes in more detail.

Scanning behavior changes

For devices scanning HTTPS-configured WSUS servers

For those using proxies, we have switched to using system proxy first, rather than user proxy. This ensures that we are first trying the most secure proxy path if a proxy is needed. We will no longer fall back to user proxy for scanning WSUS servers if the policy to allow user proxy as a fallback method is not enabled. This ensures that admins must consciously enable a less secure method for scanning as doing so will put them at higher risk of attack.

If you need to allow devices to scan utilizing user proxy as a fallback method, you can do so by configuring one of the following policies:

[table][tr][td]Group Policy[/td] [td]GPEDIT > Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify intranet Microsoft update service location > Select the proxy behavior for Windows Update client for detecting updates > Allow user proxy to be used as fallback if detection using system proxy fails[/td] [/tr] [tr][td]Configuration Service Provider (CSP) policy[/td] [td]Set Update/SetProxyBehaviorForUpdateDetection to 1 - Allow user proxy to be used as a fallback if detection using system proxy fails[/td] [/tr] [tr][td]Configuration Manager[/td] [td]Configure the new Allow User Proxy for software update scans setting to Yes to allow user proxy in Microsoft Endpoint Configuration Manager, version 2010 and later.[/td] [/tr] [/table]

To further increase security, we have added the capability for customers to pin certificates (cert-pinning) and not allow scans, even with system proxy, if cert-pinning fails. This provides the highest level of security for devices but will require more overhead for the admin in order to ensure that certificate stores are properly configured.

Note: This capability is only available to those who have secured their WSUS servers with TLS protocol/HTTPS.

To enable cert-pinning, simply add the correct certificates to the new WSUS certificate store. Devices will then automatically begin enforcing cert-pinning when scanning your WSUS server. If no certificates are in your WSUS certificate store, cert-pinning will not be enforced. Further, if you do not wish devices to have this extra layer of security upon scan, you can ensure that cert-pinning is not enforced by configuring one of the following policies:

[table][tr][td]Group Policy[/td] [td]GPEDIT > Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify intranet Microsoft update service location > Do not enforce TLS certificate pinning for Windows Update client for detecting updates[/td] [/tr] [tr][td]Configuration Service Provider (CSP) policy[/td] [td]Set Update/DoNotEnforceEnterpriseTLSCertPinningForUpdateDetection to 1 - Do not enforce certificate pinning[/td] [/tr] [/table]

For devices scanning HTTP-configured WSUS servers

For those devices scanning HTTP-configured WSUS servers, there have been no additional changes since those we introduced with the September 2020 cumulative update.

For online scans

The order of proxy selection for online scans, if a proxy is needed, has changed:

Old behavior:

Scan with user proxy.

If user proxy fails, attempt scan with system proxy.

New behavior as of the January 2021 cumulative update:

Scan with system proxy.

If system proxy fails, attempt scan with user proxy.

This change ensures that we first try the most secure proxy path if a proxy is needed.

Note: For user-driven, interactive scenarios, we always use the user proxy, if one is available, regardless of policy configuration.

Next steps

To prevent scan failures and ensure the highest level of security, please follow these recommendations:

Don’t enable user proxy.

If you require user proxy, enable user proxy via “Select the proxy behavior for Windows Update client for detecting updates” to ensure that devices do not encounter scan issues.
Note: While this will allow you to fallback to use user proxy for scans against your WSUS server, you should be leveraging this process only as a stop gap to continue getting updates while transitioning to system proxy or no proxy.

Secure your WSUS server with TLS protocol/HTTP. This is pivotal to maintain the chain of trust and prevent attacks on your client computers, see Recommendations for greater security in the previous Changes to improve security for Windows devices scanning WSUS blog.

When scanning against a TLS/HTTPS-configured WSUS server, leverage cert-pinning to get the highest level of security and keep your devices protected. (Reminder that this requires populating the device’s certificate store.)

Click to expand...

Source: https://techcommunity.microsoft.com/...s/ba-p/2053668

Tweet

— Twitter API (@user) View on Twitter
Click to expand...

modernhistorian · Mar 15, 2024

Must scan device after each startup

I installed a dual serial port card in a PCIe slot in my Acer i7 desktop, Win 10 Home. It works until the computer is restarted, then device manager lists the ports as hidden and says they are not physically connected. If I right click the device and scan for hardware changes, they will work until the next time the machine is shut down and restarted. The manufacturer suggests putting them in a different slot, but that is not helpful as there is only one PCIe slot. Can anyone suggest a way of fixing this or, alternately, is rhere a way to force windows to scan devices for hardware changes at each startup? Thanks for any help.

Windows 10: WSUS Dual Scan - HELP

WSUS Dual Scan - HELP

WSUS Dual Scan - HELP

WSUS Dual Scan - HELP

WSUS Dual Scan - HELP - Similar Threads - WSUS Dual Scan

WSUS Dual Scan - HELP

WSUS Dual Scan - HELP

Allow Windows Online Update with WSUS scan source policy enabled

Allow Windows Online Update with WSUS scan source policy enabled

Replicate WSUS 2012 to WSUS 2022

Replicate WSUS 2012 to WSUS 2022

Computer isn't scanning as intended for windows update from WSUS

Scan changes and certificates add security for Windows 10 using WSUS

Help with dual monitors