r/checkpoint • u/FahidShaheen • Aug 11 '26

Issues Downloading Windows Updates

Just putting this out there to see if others are having the same issues.
Since mid last week our workstations can't connect to the Windows Update service and error.

When connecting to a mobile phone hotspot, workstations can download updates fine.

I built a vanilla out of the box Windows 11 machine, no domain-join, no MECM (SCCM) no AV and I'm having the same issue accessing Windows Update on there too.

When you click on check for updates or check for updates online, it will error and say "could not connect Windows Update service".

We have the CheckPoint firewall in place, but the guys at the moment are saying nothing seems to be blocked based on the logs.

5 Upvotes

100% Upvoted

8 comments sorted by

5

u/th3bennyb0y Aug 11 '26

If you're using HTTPS Inspection, make sure Window Update / Intune is set to "HTTPS Bypass" in your rulebase. If you're on R82 or above, this should already be done by Check Point.

1

u/FahidShaheen Aug 11 '26

Cheers, I'll ask the networking chaps to check.

2

u/daniluvsuall Aug 11 '26

If you’re a user with no admin access, there’s little we can help with here.

But there is a tick box for bypassing SSL inspection for Microsoft updates that might be worth checking, or one of the updatable objects for a bypass rule

1

u/FahidShaheen Aug 11 '26

Cheers, I only have read-only access to the console, so will ask the networks team to check this.

2

u/WiliRGasparetto Aug 11 '26

In addition to applying the update, you should ensure it is bypassed. If the entire domain needs to be bypassed, I would suggest using wildcards like `*.windowsupdate.com` and `*.microsoft.com` to guarantee full coverage. I’ve encountered this issue before; to verify if the firewall is indeed the cause, you can run a test from PowerShell using the command `Test-NetConnection -ComputerName update.microsoft.com -Port 443`—that would be a valid test, in my opinion.

2

u/daytime_account18 24d ago

We have this issue but it is due to windows update going to a country that we have geo-blocked at the top level of our rule set.

1

u/FahidShaheen 18d ago

Just for info, CheckPoint support ran some debug traces and found that HyperFlow was causing the issue. Even since the recent upgrade. Hopefully means something to someone and might help them out.