Vista - Windows Firewall blocks Windows Update

Hi,
My Father In laws PC hasn't been getting windows updates since christmas.
After investigation I have found that disabling Windows Firewall solves the
problem. (turn it on and I can't get updates, turn it off and updates start
working again).
If I look in Update Log I can see errors;
0x8024402c & 80072ee7.
but none of the pages I found seem to rectify the error.
Don't want firewall off as a permanent solution. What exception is needed to
allow windows update? I can only assume father in law clicked "block" at some
point but I have no idea how to undo.
Regards,
Cameron.

This suggests a third-party firewall is installed. If so, you only want one
(1) firewall enabled at any given time.

Camsaway wrote:
> Hi,
> My Father In laws PC hasn't been getting windows updates since christmas.
> After investigation I have found that disabling Windows Firewall solves
> the
> problem. (turn it on and I can't get updates, turn it off and updates
> start
> working again).
> If I look in Update Log I can see errors;
> 0x8024402c & 80072ee7.
> but none of the pages I found seem to rectify the error.
> Don't want firewall off as a permanent solution. What exception is needed
> to
> allow windows update? I can only assume father in law clicked "block" at
> some point but I have no idea how to undo.
> Regards,
> Cameron.

no 3PT F/W. Any ideas? Anyway to see what windows F/W is doing with the
requests? How do I see what has been selected as "Block" in Win Firewall?

"PA Bear [MS MVP]" wrote:

> This suggests a third-party firewall is installed. If so, you only want one
> (1) firewall enabled at any given time.
>
> Camsaway wrote:
> > Hi,
> > My Father In laws PC hasn't been getting windows updates since christmas.
> > After investigation I have found that disabling Windows Firewall solves
> > the
> > problem. (turn it on and I can't get updates, turn it off and updates
> > start
> > working again).
> > If I look in Update Log I can see errors;
> > 0x8024402c & 80072ee7.
> > but none of the pages I found seem to rectify the error.
> > Don't want firewall off as a permanent solution. What exception is needed
> > to
> > allow windows update? I can only assume father in law clicked "block" at
> > some point but I have no idea how to undo.
> > Regards,
> > Cameron.
>
>

First, please make certain that Automatic Updates is enabled (cf.
http://www.microsoft.com/windows/dow...dowsvista.mspx).

With its default settings, Windows Firewall should *not* be interfering
here. To restore the defaults, click on/open Start | Control Panel |
Security | Windows Firewall | Allow a program through Windows Firewall |
Advanced (tab): click on the Restore Defaults button here, OK your way out &
test.

What anti-virus application or security suite is installed and is the
subscription current?

Has a Norton or McAfee application ever been installed on this machine
(e.g., a free-trial version that came preinstalled when the computer was
purchased)?

Additional references:

Understanding Windows Firewall settings
http://windowshelp.microsoft.com/Win...7dbee1033.mspx

Allow a program to communicate through Windows Firewall
http://windowshelp.microsoft.com/Win...b21bc1033.mspx

Firewall: frequently asked questions
http://windowshelp.microsoft.com/Win...296ce1033.mspx
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Camsaway wrote:
> no 3PT F/W. Any ideas? Anyway to see what windows F/W is doing with the
> requests? How do I see what has been selected as "Block" in Win Firewall?
>
> "PA Bear [MS MVP]" wrote:
>> This suggests a third-party firewall is installed. If so, you only want
>> one (1) firewall enabled at any given time.
>>
>> Camsaway wrote:
>>> Hi,
>>> My Father In laws PC hasn't been getting windows updates since
>>> christmas.
>>> After investigation I have found that disabling Windows Firewall solves
>>> the
>>> problem. (turn it on and I can't get updates, turn it off and updates
>>> start
>>> working again).
>>> If I look in Update Log I can see errors;
>>> 0x8024402c & 80072ee7.
>>> but none of the pages I found seem to rectify the error.
>>> Don't want firewall off as a permanent solution. What exception is
>>> needed
>>> to
>>> allow windows update? I can only assume father in law clicked "block" at
>>> some point but I have no idea how to undo.
>>> Regards,
>>> Cameron.

Thanks. Will check all that when I'm there again in a couple of days.

PC did have Norton pre-installed but we removed that. AVAST anti-virus is
running. Nothing else.

NOTE: Everything was working fine through Oct, Nov, Dec - According to
winupdate it started failed on 27-Dec so somethign must have changed at that
point.

Will get back to you.
Cam.

=====================

"PA Bear [MS MVP]" wrote:

> First, please make certain that Automatic Updates is enabled (cf.
> http://www.microsoft.com/windows/dow...dowsvista.mspx).
>
> With its default settings, Windows Firewall should *not* be interfering
> here. To restore the defaults, click on/open Start | Control Panel |
> Security | Windows Firewall | Allow a program through Windows Firewall |
> Advanced (tab): click on the Restore Defaults button here, OK your way out &
> test.
>
> What anti-virus application or security suite is installed and is the
> subscription current?
>
> Has a Norton or McAfee application ever been installed on this machine
> (e.g., a free-trial version that came preinstalled when the computer was
> purchased)?
>
> Additional references:
>
> Understanding Windows Firewall settings
> http://windowshelp.microsoft.com/Win...7dbee1033.mspx
>
> Allow a program to communicate through Windows Firewall
> http://windowshelp.microsoft.com/Win...b21bc1033.mspx
>
> Firewall: frequently asked questions
> http://windowshelp.microsoft.com/Win...296ce1033.mspx
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Client - since 2002
>
>
> Camsaway wrote:
> > no 3PT F/W. Any ideas? Anyway to see what windows F/W is doing with the
> > requests? How do I see what has been selected as "Block" in Win Firewall?
> >
> > "PA Bear [MS MVP]" wrote:
> >> This suggests a third-party firewall is installed. If so, you only want
> >> one (1) firewall enabled at any given time.
> >>
> >> Camsaway wrote:
> >>> Hi,
> >>> My Father In laws PC hasn't been getting windows updates since
> >>> christmas.
> >>> After investigation I have found that disabling Windows Firewall solves
> >>> the
> >>> problem. (turn it on and I can't get updates, turn it off and updates
> >>> start
> >>> working again).
> >>> If I look in Update Log I can see errors;
> >>> 0x8024402c & 80072ee7.
> >>> but none of the pages I found seem to rectify the error.
> >>> Don't want firewall off as a permanent solution. What exception is
> >>> needed
> >>> to
> >>> allow windows update? I can only assume father in law clicked "block" at
> >>> some point but I have no idea how to undo.
> >>> Regards,
> >>> Cameron.
>
>

> PC did have Norton pre-installed but we removed that. AVAST anti-virus is
> running. Nothing else.

1. Uninstall any remaining Norton software (including LiveUpdate and any
Norton Add-ons) via Control Panel | Programs | Uninstall a program (or
Control Panel | Programs and Features, if using Classic view).

2. Download the Norton Removal Tool to your desktop:
http://service1.symantec.com/SUPPORT...05033108162039

3. Right-click on the saved download and select Run as Administrator.

4. Reboot.
--
~PA Bear


Camsaway wrote:
> Thanks. Will check all that when I'm there again in a couple of days.
>
> PC did have Norton pre-installed but we removed that. AVAST anti-virus is
> running. Nothing else.
>
> NOTE: Everything was working fine through Oct, Nov, Dec - According to
> winupdate it started failed on 27-Dec so somethign must have changed at
> that
> point.
>
> Will get back to you.
> Cam.
>
> =====================
>
> "PA Bear [MS MVP]" wrote:
>
>> First, please make certain that Automatic Updates is enabled (cf.
>> http://www.microsoft.com/windows/dow...dowsvista.mspx).
>>
>> With its default settings, Windows Firewall should *not* be interfering
>> here. To restore the defaults, click on/open Start | Control Panel |
>> Security | Windows Firewall | Allow a program through Windows Firewall |
>> Advanced (tab): click on the Restore Defaults button here, OK your way
>> out
>> & test.
>>
>> What anti-virus application or security suite is installed and is the
>> subscription current?
>>
>> Has a Norton or McAfee application ever been installed on this machine
>> (e.g., a free-trial version that came preinstalled when the computer was
>> purchased)?
>>
>> Additional references:
>>
>> Understanding Windows Firewall settings
>> http://windowshelp.microsoft.com/Win...7dbee1033.mspx
>>
>> Allow a program to communicate through Windows Firewall
>> http://windowshelp.microsoft.com/Win...b21bc1033.mspx
>>
>> Firewall: frequently asked questions
>> http://windowshelp.microsoft.com/Win...296ce1033.mspx
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>
>>
>> Camsaway wrote:
>>> no 3PT F/W. Any ideas? Anyway to see what windows F/W is doing with the
>>> requests? How do I see what has been selected as "Block" in Win
>>> Firewall?
>>>
>>> "PA Bear [MS MVP]" wrote:
>>>> This suggests a third-party firewall is installed. If so, you only
>>>> want
>>>> one (1) firewall enabled at any given time.
>>>>
>>>> Camsaway wrote:
>>>>> Hi,
>>>>> My Father In laws PC hasn't been getting windows updates since
>>>>> christmas.
>>>>> After investigation I have found that disabling Windows Firewall
>>>>> solves
>>>>> the
>>>>> problem. (turn it on and I can't get updates, turn it off and updates
>>>>> start
>>>>> working again).
>>>>> If I look in Update Log I can see errors;
>>>>> 0x8024402c & 80072ee7.
>>>>> but none of the pages I found seem to rectify the error.
>>>>> Don't want firewall off as a permanent solution. What exception is
>>>>> needed
>>>>> to
>>>>> allow windows update? I can only assume father in law clicked "block"
>>>>> at
>>>>> some point but I have no idea how to undo.
>>>>> Regards,
>>>>> Cameron.

I have exactly the same problem.

I did a clean build of Vista Home Premium on top of an old XP machine
(custom/new install rather than upgrade).

Windows Activation, Windows Genuine Validation, and Windows Update are all
blocked by Windows Firewall.

There is no other AV or Firewall software on the machine (although the
previous build did have) and the only way that I can check for updates is to
turn off Windows Firewall.

Any ideas?


"PA Bear [MS MVP]" wrote:

> > PC did have Norton pre-installed but we removed that. AVAST anti-virus is
> > running. Nothing else.
>
> 1. Uninstall any remaining Norton software (including LiveUpdate and any
> Norton Add-ons) via Control Panel | Programs | Uninstall a program (or
> Control Panel | Programs and Features, if using Classic view).
>
> 2. Download the Norton Removal Tool to your desktop:
> http://service1.symantec.com/SUPPORT...05033108162039
>
> 3. Right-click on the saved download and select Run as Administrator.
>
> 4. Reboot.
> --
> ~PA Bear
>
>
> Camsaway wrote:
> > Thanks. Will check all that when I'm there again in a couple of days.
> >
> > PC did have Norton pre-installed but we removed that. AVAST anti-virus is
> > running. Nothing else.
> >
> > NOTE: Everything was working fine through Oct, Nov, Dec - According to
> > winupdate it started failed on 27-Dec so somethign must have changed at
> > that
> > point.
> >
> > Will get back to you.
> > Cam.
> >
> > =====================
> >
> > "PA Bear [MS MVP]" wrote:
> >
> >> First, please make certain that Automatic Updates is enabled (cf.
> >> http://www.microsoft.com/windows/dow...dowsvista.mspx).
> >>
> >> With its default settings, Windows Firewall should *not* be interfering
> >> here. To restore the defaults, click on/open Start | Control Panel |
> >> Security | Windows Firewall | Allow a program through Windows Firewall |
> >> Advanced (tab): click on the Restore Defaults button here, OK your way
> >> out
> >> & test.
> >>
> >> What anti-virus application or security suite is installed and is the
> >> subscription current?
> >>
> >> Has a Norton or McAfee application ever been installed on this machine
> >> (e.g., a free-trial version that came preinstalled when the computer was
> >> purchased)?
> >>
> >> Additional references:
> >>
> >> Understanding Windows Firewall settings
> >> http://windowshelp.microsoft.com/Win...7dbee1033.mspx
> >>
> >> Allow a program to communicate through Windows Firewall
> >> http://windowshelp.microsoft.com/Win...b21bc1033.mspx
> >>
> >> Firewall: frequently asked questions
> >> http://windowshelp.microsoft.com/Win...296ce1033.mspx
> >> --
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-IE, Mail, Security, Windows Client - since 2002
> >>
> >>
> >> Camsaway wrote:
> >>> no 3PT F/W. Any ideas? Anyway to see what windows F/W is doing with the
> >>> requests? How do I see what has been selected as "Block" in Win
> >>> Firewall?
> >>>
> >>> "PA Bear [MS MVP]" wrote:
> >>>> This suggests a third-party firewall is installed. If so, you only
> >>>> want
> >>>> one (1) firewall enabled at any given time.
> >>>>
> >>>> Camsaway wrote:
> >>>>> Hi,
> >>>>> My Father In laws PC hasn't been getting windows updates since
> >>>>> christmas.
> >>>>> After investigation I have found that disabling Windows Firewall
> >>>>> solves
> >>>>> the
> >>>>> problem. (turn it on and I can't get updates, turn it off and updates
> >>>>> start
> >>>>> working again).
> >>>>> If I look in Update Log I can see errors;
> >>>>> 0x8024402c & 80072ee7.
> >>>>> but none of the pages I found seem to rectify the error.
> >>>>> Don't want firewall off as a permanent solution. What exception is
> >>>>> needed
> >>>>> to
> >>>>> allow windows update? I can only assume father in law clicked "block"
> >>>>> at
> >>>>> some point but I have no idea how to undo.
> >>>>> Regards,
> >>>>> Cameron.
>
>

To avoid confusion, please begin a new thread about your specific problems.
State your IE version and full Windows version (e.g., WinXP SP3; Vista SP2)
in your first post.

Jon HK wrote:
> I have exactly the same problem.
>
> I did a clean build of Vista Home Premium on top of an old XP machine
> (custom/new install rather than upgrade).
>
> Windows Activation, Windows Genuine Validation, and Windows Update are all
> blocked by Windows Firewall.
>
> There is no other AV or Firewall software on the machine (although the
> previous build did have) and the only way that I can check for updates is
> to
> turn off Windows Firewall.
>
> Any ideas?
<snip hijacked thread from Apr-09>

[KMA1623]

Quote:

Originally Posted by PA Bear [MS MVP]

To avoid confusion, please begin a new thread about your specific problems.
State your IE version and full Windows version (e.g., WinXP SP3; Vista SP2)
in your first post.

Jon HK wrote:
> I have exactly the same problem.
>
> I did a clean build of Vista Home Premium on top of an old XP machine
> (custom/new install rather than upgrade).
>
> Windows Activation, Windows Genuine Validation, and Windows Update are all
> blocked by Windows Firewall.
>
> There is no other AV or Firewall software on the machine (although the
> previous build did have) and the only way that I can check for updates is
> to
> turn off Windows Firewall.
>
> Any ideas?
<snip hijacked thread from Apr-09>

I found that by creating an outbound rule for %windir%\system32\svchost.exe, windows update can access the internet.

[Growler74]

Hi guys...

I have had a similar problem which has taken me days and hours to sort out. I have been combing through this forum and every other forum that has purported to have a fix... but none worked for me. Finally I got onto Microsoft Support. Attached below is my email describing my problem (as well as the fixes I tried), and the reply from the support guy. It worked first go, however I have not seen this fix on any forum or website.

HERE IS MY TECH SUPPORT REQUEST:

Quote:

"Windows Update has stopped working on my computer. I use manual update. My computer is on my home network connected via LAN to my broadband modem/router. It connects directly to the internet and I do not use a proxy. There are no other computers connected to the network. There is no requirement for a VPN. I have not changed this configuration in over 3 years and update has worked successfully over this time. My last successful update was 21Dec2010.

From that time on, I have received error 8024402C everytime I try to update. I previously was running "Trend Micro Internet Security 2010". I had uninstalled that antivirus program and was then running "AVG antivirus". I did not use their firewall - I used "windows firewall".

I have tried now numerous times to run "Windows Update" but kept receiving the above error. THE ONLY TIME "WINDOWS UPDATE" WORKS SUCCESSFULLY IS WHEN I DISABLE "WINDOWS FIREWALL".

I have now spent approximately 10hrs trying to solve this problem. So far I have tried the following steps:
1. I have completed all the steps in Knowledge Base Article ID: 900936
2. I have completed all the steps in Knowledge Base Article ID: 836941
3. I have uninstalled ALL antivirus software. THE IS CURRENTLY NO ANTIVIRUS SOFTWARE RUNNING ON MY COMPUTER.
4. I have "port forwarded" ports 80 and 443 in my router to ensure they are not being blocked.
5. I have made sure all my TCP/IPv4 settings are set to detect settings automatically.
6. I have searched a number of forum articles and tried a number of other suggested fixes.
7. I have gone into "Windows Firewall" settings > Exceptions and created an exception for "wuapp.exe"
8. I have gone into "Administrative Tools" > "Windows Firewall with Advanced Security" and manually created an "outbound and inbound exception" for "%SystemRoot%\System32\svchost.exe" on ports 80 & 443.

None of these things have worked. The only way I can get "Windows Update" to work is by turning off "Windows Firewall". However I do not wish to have to leave windows firewall off to receive my updates.

I have attached the windowsupdate.log file to assist."

HERE IS THE TECH SUPPORT REPLY:

Quote:

"Problem
=======
There is an error “8024402F” when you perform Windows Update

Solution
=======
1. Click ”Start”-Type in the start search box “ncpa.cpl” and press Enter.
2 .Right click Local Area Connection (Which network adaptor you are using to access internet now) and select “Properties”
3. Double Click “Internet Protocol Version 4(TCP/IPv4)” in the Local Area Connection Properties Windows
4. Select “Use the following DNS server address” and type in the IP address 4.2.2.2 as “Preferred DNS server” and press twice “OK”
5. Try to perform scan Windows update again.

Please take your time with the above suggestions and let me know the results of this issue at your earliest convenience. If anything in my email is unclear, please don’t hesitate to contact me. I am glad to help.

Thank you for your support and understanding."

THIS WORKED! (Note: He has addressed a different error code in the title) I HAVE NOW SENT THE BELOW REPLY ASKING WHY IT WASN'T REQUIRED BEFORE AND WHY IT WORKS NOW:

Quote:

"I have never needed to enter an IP address in the DNS server before. Can you tell me why this has changed and why that this is now required?

Has there been a change to the Microsoft download servers?

Do I have to leave this in there all the time now or can it be removed at a later date?"

SO... this worked for me and I hope it works for others (but it may not). I hope this helps someone save some serious time. I still don't know why this has worked and am awaiting a reply from Microsoft Support.

Growler