Microsoft WUDO (Windows Update Delivery Optimization) servers in China?

Andrej Gorochovik 0 Reputation points
2023-03-14T11:42:42.11+00:00

Hi, we had a report from our security provider, that some of our computers started communicating IP in PRC on destination port 7680, which is commonly used for Microsoft WUDO (Windows Update Delivery Optimization). They advised us to make sure it is not a security breach.

IPs are:

60.9.1.222

60.9.3.254

60.9.1.55

172.10.0.23

Did Microsoft recently enrolled PRC located servers into global update list or we should worry about a hacking attempt?

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,747 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 43,941 Reputation points
    2023-03-15T16:19:45.8366667+00:00

    Hello there,

    You can try to close the port and see if delivery optimisation works to make sure this is created by windows service only.

    Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device. The port must be set to accept inbound traffic through your firewall. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization.

    Hope this resolves your Query !!

    --If the reply is helpful, please Upvote and Accept it as an answer--

    0 comments
  2. Narkis Engler 0 Reputation points Microsoft Employee
    2023-03-16T02:30:08.6166667+00:00

    Hi Andrej,

    It is possible the default configuration of Delivery Optimization's "Download Mode" is resulting in connection attempts from legit peers in a different region.

    Please take a look at the article here to learn more: https://learn.microsoft.com/en-us/windows/deployment/do/waas-delivery-optimization-reference#download-mode

    Regarding how Delivery Optimization verifies the content it pulls from peers please take a look at the following: https://learn.microsoft.com/en-us/windows/deployment/do/delivery-optimization-workflow

    0 comments