Summary
- Microsoft is reminding admins that Windows Update can fail when firewalls or proxies intercept TLS traffic or do not allow the required Windows Update DNS subdomains through.
- Affected environments are Windows devices that reach Microsoft Windows Update directly; devices using IT-managed WSUS servers are not in scope for these exceptions.
- Admins should review the Windows Update audit log and use the published troubleshooting guidance to identify the specific connection issue.
- Update proxy and firewall allow lists to trust the Windows Update wildcard DNS hosts and subdomains so devices can continue reaching update services.
- If this is not corrected, affected devices may stop receiving security updates.
Microsoft 365 Message Center ID: MC1465017
Primary Service: Windows
Admin Impact: Medium
User Impact: Low
Release Start: 31 Aug 2026
Release End: 31 Aug 2026
Last Modified: September 1, 2026
Category: Message Center
Tags: New feature, Admin impact
Status: Launched
Products & Platforms: Windows
History
8/31/2026 Item Added to Message Center
Microsoft Message
By design, Windows Update doesn’t trust servers that don’t have TLS certificates issued by an actual Windows Update trust anchor. We published guidance in May 2026 to help you diagnose and fix connection issues that result from this design.
Rollout schedule
- This guidance was published in May to help with ongoing troubleshooting.
- Connection issues might be ongoing until you apply the existing solution.
Impact on your organization
Your firewalls and proxies might block access to the trustworthy and necessary Windows Update service if your configuration is either intercepting TLS connections or isn’t passing TLS requests through for the necessary DNS subdomains. The published guide helps you diagnose and fix related issues.
Action required/recommendations
Diagnose connection issues by checking the Windows Update audit log. Our detailed guidance lists the recommended PowerShell command and four error codes that can confirm the issue.
To remedy the situation, trust all the DNS hosts and subdomains related to wildcard FQDN for the connection to work properly. For example, a recommended DNS host name *.update.microsoft.com represents all the following hosts and subdomains:
- update.microsoft.com
- sls.update.microsoft.com
- tas02.sls.update.microsoft.com
Update your proxy and firewall configurations if any of these subdomains are missing. If your devices connect to an IT-managed Windows Server Update Services (WSUS) server, these exceptions aren’t necessary.
Compliance considerations
Devices that cannot reach the Windows Update service will stop receiving security updates.
Additional information
- Configuring firewall and proxies for smooth Windows updates
- Windows Update security
- Transport Layer Security protocol
- Connection endpoints for Windows 11 Enterprise
- Scan changes and certificates add security for Windows devices using WSUS for updates