Previously in Windows 7 and Vista, you could configure Windows Firewall to allow specific outbound traffic via "svchost". For example, to allow outbound traffic for Windows update, you would allow the program "%SystemRoot%\System32\svchost.exe" with "wuauserv" selected under "Apply to this service".
In Windows 8.1 and 10 that functionality no longer exists. Creating such a rule results in network connectivity errors for both OS. If a rule is created to allow "%SystemRoot%\System32\svchost.exe" and "Apply to services only" windows update also fails (meaning there is more than the defined services at work here). The only way I can get it to work is if I just allow "%SystemRoot%\System32\svchost.exe" completely or "%SystemRoot%\System32\svchost.exe" and"Apply to all programs and services", which defeats the purpose of me trying to block all services, but those that require network access.
Any help in addressing this problem is appreciated.