Blog Post

Windows IT Pro Blog
4 MIN READ

Changes to improve security for Windows devices scanning WSUS

AriaUpdated's avatar
AriaUpdated
Icon for Microsoft rankMicrosoft
Sep 08, 2020
With the September 2020 cumulative update for Windows 10, we introduced changes that help improve the security of devices that scan Windows Server Update Services (WSUS) for their updates. This post ...
Updated Feb 01, 2023
Version 4.0
servicing and updates
Eric_Ellis_MSFT's avatar
Eric_Ellis_MSFT
Icon for Microsoft rankMicrosoft
Sep 28, 2020

FYI, the change affects not only Windows 10, but also Windows 8.1, Windows 8/8.1 Embedded, Windows Server 2012, and Windows Server 2012 R2. The following are links to related Sept 2020 update articles, and an excerpt from them:

 

September 8, 2020—KB4577038 (Monthly Rollup) -- Windows Server 2012 & Windows Embedded 8 Standard
https://support.microsoft.com/en-us/help/4577038

 

September 8, 2020—KB4577066 (Monthly Rollup) -- Windows 8.1, Windows Server 2012 R2 & Windows Embedded 8.1
https://support.microsoft.com/en-us/help/4577066

 

Addresses a security vulnerability issue with user proxies and HTTP-based intranet servers. After you install this update, HTTP-based intranet servers cannot leverage a user proxy to detect updates by default. Scans that use these servers will fail if the clients do not have a configured system proxy. If you must leverage a user proxy, you must configure the behavior by using the Windows Update policy “Allow user proxy to be used as a fallback if detection using system proxy fails.” This change does not affect customers who secure their Windows Server Update Services (WSUS) servers that use the Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocols. For more information, see Improving security for devices receiving updates via WSUS.