> Source: [sk184728](https://support.checkpoint.com/results/sk/sk184728) # sk184728 - Windows 11 update fails when Content Awareness blade is in use | Property | Value | |----------|-------| | Solution ID | sk184728 | | Date Created | 2026-03-09 | | Last Modified | 2026-03-11 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | ## Symptoms - * Windows 11 update fails to download or stuck at 100% and not completed. * SmartConsole logs show this error: "*Content Awareness - Error while processing 'xxxxx-yyy-zzz-aaa-bbbbb': File appears corrupted (13)*". * The policy (or policy layer) includes at least one type of Content object or uses Detailed or Extended logging. * Disabling the Content Awareness blade resolves the issue. Clearing all content objects and ensuring that none of the policy rules uses Detailed or Extended logging also resolves the issue (it has the same effect as disabling the blade). * When Content Awareness is configured to inspect archives (in SmartConsole \> **Manage \& settings** \> **Content Awareness** \> **Inspect archives** is selected, SmartConsole logs may show a different error: "*Failed to extract (2)*". ## Cause Previously, Windows update files had the appx. extension. The file naming changed so that now they include multiple hyphens (`-`) in their names and no file extension. The earlier classification logic identified files based on their extension. Content Awareness was set to exclude APPX files from inspection, but because the new Windows update files did not have any file extension, the Content Awareness blade could not recognize and handle them appropriately. ## Solution [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing it. For faster resolution and verification, collect these files: 1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case. 2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case. **Hotfix installation instructions:** Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597). **Overview** With this Hotfix, you can now set the Security Gateway to detect and inspect the APPX files, by configuring this kernel global parameter: `fileapp_skip_appx_with_data_descriptor` By default, the value is set to 0, and the Security Gateway inspects the APPX files. |----------------------------------------------|----------------------------------------------------------| | Kernel Parameter Value | Security Gateway Behavior | | `fileapp_skip_appx_with_data_descriptor = 0` | The Security Gateway inspects the APPX files. | | `fileapp_skip_appx_with_data_descriptor = 1` | The Security Gateway skips inspection of the APPX files. | ### Procedure You can configure the applicable value for this kernel parameter temporarily (in the current session only - does not survive reboot), or permanently (survives reboot). **Important** - In ClusterXL, you must configure all cluster members in the same way. |--------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Deployment | Temporary Configuration | Permanent Configuration | | Security Gateway, ClusterXL | In Gaia Clish, or in the Expert mode: `fw ctl set int fileapp_skip_appx_with_data_descriptor ` | In Gaia Clish, or in the Expert mode: `fw ctl set -f int fileapp_skip_appx_with_data_descriptor ` | | Security Group in ElasticXL, Security Group in Maestro, Security Group on Scalable Chassis | In Gaia gClish: `fw ctl set int fileapp_skip_appx_with_data_descriptor ` In the Expert mode: `g_fw ctl set int fileapp_skip_appx_with_data_descriptor ` | In Gaia gClish: `fw ctl set -f int fileapp_skip_appx_with_data_descriptor ` In the Expert mode: `g_update_conf_file $FWDIR/modules/fwkern.conf fileapp_skip_appx_with_data_descriptor` `` | To **see** the current value of this kernel parameter, run: |--------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------| | Deployment | Command | | Security Gateway, ClusterXL | In Gaia Clish, or in the Expert mode: `fw ctl get int fileapp_skip_appx_with_data_descriptor` | | Security Group in ElasticXL, Security Group in Maestro, Security Group on Scalable Chassis | In Gaia gClish: `fw ctl get int fileapp_skip_appx_with_data_descriptor` In the Expert mode: `g_fw ctl get int fileapp_skip_appx_with_data_descriptor` | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content