Hi Girish,
Thank you for posting here.
I found an explanation in this article "Secure WSUS 3.0 Deployment".
- Updates consist of two parts: the metadata that describes the update, and the files to install the update on a computer. Microsoft mitigates the risk of sending update files over an unencrypted channel by signing each update. In addition to signing each
update, a hash is computed and sent with the metadata for each update. When an update is downloaded, WSUS checks the digital signature and hash. If the update has been altered, it is not installed.
For reference, the following thread also discusses this issue, and Lawrence also did some analysis: "Does
WSUS verify patch authenticity?"
Hope the above can help you.
Regards,
Yic
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact
tnmff@microsoft.com.