After changing all outbound to "block" in Windows Firewall, I found Window update is blocked too. I know I have to add a new rule to allow it, but I can't find any predefined rule about the update service, and I don't know which program to allow in the rule. Any tips?