WN11-CC-000206 - Windows Update must not obtain updates from other PCs on the internet.

Information

Windows 11 allows Windows Update to obtain updates from additional sources instead of Microsoft. In addition to Microsoft, updates can be obtained from and sent to PCs on the local network as well as on the internet. This is part of the Windows Update trusted process; however, to minimize outside exposure, obtaining updates from or sending to systems on the internet must be prevented.

Note: A different registry location is needed when systems are managed by Intune versus GPO.

Solution

For GPO-managed systems:

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Delivery Optimization >> 'Download Mode' to 'Enabled' with any option except 'Internet' selected.

Acceptable selections include:
Bypass (100)
Group (2)
HTTP only (0)
LAN (1)
Simple (99)

For Intune-managed systems:

Revise the Intune policy to enable Download Mode for Delivery Optimization.

Item Details

Audit Name: DISA Microsoft Windows 11 STIG v2r8

Category: CONFIGURATION MANAGEMENT

Plugin: Windows

Control ID: ad665be675afebd903f3bd2381583cc1e36664ce549d0037110fbf2a3bc49486

Detections

Analytics

WN11-CC-000206 - Windows Update must not obtain updates from other PCs on the internet.

Information

Solution

See Also

Item Details