Allow traffic by "client type" condition

[Sysprog_Alexey]

Hello! 

I have a task: block all windows updates, but allow Microsoft-CryptoAPI (client type). 

Is there any way to accomplish this? 

 

[PhoneBoy · Accepted solution]

The only way I can think to do it is via a custom Application Control signature.
This will likely require HTTPS Inspection 
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...