Technical Note: Windows Critical and Security Update Scans Taking Long Time to Complete

[FortiKoala]

Description

Windows Critical and Security Update Scans Taking Long Time to Complete

Scope
Version:   All
Solution

Version:  All

Issue:  Scans requiring validation of Windows Critical and Security Updates take a long time to complete.

Network Sentry leverages the Windows Update tool to check for Critical Updates and Security Updates during an operating system scan. Depending upon the configuration of the scan in the Endpoint Compliance Policy, the agent on the endstation will try to connect to either the Microsoft Windows Update web site (and any other associated sites) or an internal server that is providing the Windows Updates (defined in the Windows Critical Updates section of the scan configuration).

The amount of time a scan for Windows Updates can take will vary based upon the following factors:

• Network performance between the endstation and the Microsoft web site or internal server.
• If requiring communication to the Microsoft web sites, whether or not the appropriate sites are reachable, this includes...
• Domains resolving properly by Network Sentry when scans are done in isolation, see Domains to Add to Network Sentry Allowed Domains List (zones.common)
• Firewalls allowing the traffic through. 
• Whether or not the endstation is missing updates. If there are some missing, the Windows Update tool will attempt to download and install the required updates. This could take time depending upon how many updates are needed. 
• The responsiveness of the Windows servers being accessed.

See also:
Scan Hangs at Windows Critical and Security Updates