Is ctldl.windowsupdate.com legit?

Question

Is&nbsp;ctldl.windowsupdate.com legit? It seems malicious on VT. I have came across in the logs:&nbsp;"svchost.exe has initiated a HTTP connection to http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?blabla"

kidd_ip · Answer

nopnop&nbsp;Check this:&nbsp;An automatic updater of untrusted certificates is available for Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 - Microsoft Support&nbsp;

nopnop · Answer

It says for Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2. But where I saw is Windows 10. So, can we say still legit?

jase4000 · Answer

Updated Windows 10/11 etc doco for authrootstl.cab and disallowedcertstl.cab can be found at

https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/certificate-trust#automatic-certificate-trust-list-updates

Applies to: Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016, ✅ Windows 11, ✅ Windows 10, ✅ Azure Local 2311.2 and later

Forum Discussion

Is ctldl.windowsupdate.com legit?

Is ctldl.windowsupdate.com legit? It seems malicious on VT. I have came across in the logs:

"svchost.exe has initiated a HTTP connection to http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?blabla"

3 Replies