What resources do I need to open to update Windows when the Deny Everything policy is enabled?

Question

Windows

Good time!
Due to business necessity, a certain number of computers were removed from the general corporate network to their own subnet. Access to the global network for this subnet is provided through the Fortigate 60-C firewall. In the access rules, a ban on everything except 3-4 sites is configured. I'm currently trying to set up access for updating Windows OS and encountered the following problem: when adding the FQDN of the Windows Update Services site addresses to the allowed access policy, the operating system update fails with an error. The list of sites where the OS downloads updates is taken from here https://technet.microsoft.com/en-us/library/bb6937..., but that doesn't solve the problem. Similarly, I prescribed anti-virus software update servers, there were no problems, although the list of servers was similar in number. If someone faced such a problem, please explain what could be the problem, because. I haven't been able to solve it for a long time.
PS Do not offer to download updates from WSUS.

Answer 1

See C:\Windows\WindowsUpdate.log on affected computers.