Windows 10 download fails to BITS range requests being blocked by the firewall.

BITS uses something called "range requests" to download the file piece by piece.  So the XG may see that bytes 2000-4000 of PotentiallyEvil.exe are being downloaded.  There is no way to effectively virus scan the middle of a file (or apply things like filetype blocking) so the range request is blocked.  I'm not sure but I think bypassing the virus scanner might allow it.

From what I recall, BITS only uses range requests when downloading in the background.  Another solution is to use foreground.

See https://support.microsoft.com/en-ca/kb/922330

I have confirmed, if you create an exception for Malware scanning, it will allow BITS range requests.

Could you please describe how to create an exception for these updates?  We are having this same issue and have not been able to successfully create an exception for Office Updates. 

Web Protection, Web Content Filter, HTTP Scanning Rules
Add Rule
Source: *
Destination: *
URL Regex: microsoft.com
Action: Bypass

You might need additional rules for other domains, I don't know what the BITS requests actually use.

Hi,

I have applied this policy and still I cant download windows 10 updates it just keeps on failing.

Hi,

I have applied this policy and still I cant download windows 10 updates it just keeps on failing.

Hi jsybhdu,

What ended up finally working to allow Windows 10 machines to update Office 2016 was putting the following domain names into the Exceptions List:

officecdn.microsoft.com.edgekey.net
officecdn.microsoft.com.edgesuite.net
officecdn.microsoft.com

I did this by going to Web Protection ->Filtering Options ->Exceptions

There I created a new Exception List with only the Antivirus under Skip these checks checked and added the domains exactly how you see the above to the target domains with the option matching these URLS selected.  Once I did that, Office 2016 was able to update without further issues.