Windows update failure behind ISA server

windows update.log shows various proxy send fails error 0x8024402c

Tried all the various ISA server workrounds for destination sets, protocol
rules etc etc but still not able to get a client to consistently get past ISA
server.

Is there a definitive set up for ISA that works with update?

(cross-post added to ISA General)
"aviator" <> wrote in message news:C9B2BC2A-4F33-4329-8720-...
> windows update.log shows various proxy send fails error 0x8024402c
>
> Tried all the various ISA server workrounds for destination sets, protocol
> rules etc etc but still not able to get a client to consistently get past ISA
> server.
>


FWIW AIUI the account that is used when you make a connection
through ISA for AU or BITS is not the user account, so you have to allow
anonymous connections for those services.

BTW I think it matters what your client OS is. E.g. if XP can it at least
use the WU site to do notification and downloads manually?


> Is there a definitive set up for ISA that works with update?


Probably not here in the WU NG. Check with people who are actually using ISA? ; )


Good luck

Robert Aldwinckle
---

"Robert Aldwinckle" <> wrote in message
news:%...
> (cross-post added to ISA General)
> "aviator" <> wrote in message
> news:C9B2BC2A-4F33-4329-8720-...
>> Is there a definitive set up for ISA that works with update?
>
> Probably not here in the WU NG. Check with people who are actually using
> ISA? ; )

It is just plain old regular HTTP traffic,..nothing special,...nothing
"extra" to do. There might be some HTTPS but I'm not sure.
But as far as ISA is concerned, there is nothing special about the traffic.
It does have to be allowed anonymously ("All Users" in the ISA/TMG
terminology).

--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------
Technet Library
ISA2004
http://technet.microsoft.com/en-us/l...chNet.10).aspx
ISA2006
http://technet.microsoft.com/en-us/l...chNet.10).aspx

Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/downlo...7/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/p...s/default.mspx

Microsoft ISA Server Partners: Partner Hardware Solutions
http://www.microsoft.com/forefront/e...epartners.mspx
-----------------------------------------------------

[Forwarded to microsoft.public.isa & microsoft.public.isa.configuration via
crosspost]

aviator wrote:
> windows update.log shows various proxy send fails error 0x8024402c
>
> Tried all the various ISA server workrounds for destination sets, protocol
> rules etc etc but still not able to get a client to consistently get past
> ISA server.
>
> Is there a definitive set up for ISA that works with update?

OK. Cure:

In client execute proxycfg -p [Isa server name] it then works. Everywhere
else i've seen proxycfg -d as the recomendation, but not for me.

Any ideas as to why will be duly taken on board.

A

"PA Bear [MS MVP]" wrote:

> [Forwarded to microsoft.public.isa & microsoft.public.isa.configuration via
> crosspost]
>
> aviator wrote:
> > windows update.log shows various proxy send fails error 0x8024402c
> >
> > Tried all the various ISA server workrounds for destination sets, protocol
> > rules etc etc but still not able to get a client to consistently get past
> > ISA server.
> >
> > Is there a definitive set up for ISA that works with update?
>
>

OK. Cure:

In client execute proxycfg -p [Isa server name] it then works. Everywhere
else i've seen proxycfg -d as the recomendation, but not for me.

Any ideas as to why will be duly taken on board.

A



"Phillip Windell" wrote:

> "Robert Aldwinckle" <> wrote in message
> news:%...
> > (cross-post added to ISA General)
> > "aviator" <> wrote in message
> > news:C9B2BC2A-4F33-4329-8720-...
> >> Is there a definitive set up for ISA that works with update?
> >
> > Probably not here in the WU NG. Check with people who are actually using
> > ISA? ; )
>
> It is just plain old regular HTTP traffic,..nothing special,...nothing
> "extra" to do. There might be some HTTPS but I'm not sure.
> But as far as ISA is concerned, there is nothing special about the traffic.
> It does have to be allowed anonymously ("All Users" in the ISA/TMG
> terminology).
>
> --
> Phillip Windell
>
> The views expressed, are my own and not those of my employer, or Microsoft,
> or anyone else associated with me, including my cats.
> -----------------------------------------------------
> Technet Library
> ISA2004
> http://technet.microsoft.com/en-us/l...chNet.10).aspx
> ISA2006
> http://technet.microsoft.com/en-us/l...chNet.10).aspx
>
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Troubleshooting Client Authentication on Access Rules in ISA Server 2004
> http://download.microsoft.com/downlo...7/ts_rules.doc
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/p...s/default.mspx
>
> Microsoft ISA Server Partners: Partner Hardware Solutions
> http://www.microsoft.com/forefront/e...epartners.mspx
> -----------------------------------------------------
>
>
>

"aviator" <> wrote in message
news:C33BA192-F6E0-40CC-990C-...
> OK. Cure:
>
> In client execute proxycfg -p [Isa server name] it then works. Everywhere
> else i've seen proxycfg -d as the recomendation, but not for me.

Never seen or heard of "proxycfg -p" or "proxycfg -d" in my life,..don't
even know what it is.

I run ISA and all I do is allow outbound http to *.microsoft.com anonymously
and it "just works".
No adjustments at all whatsoever on the Clients.

But to give a fuller picture,...I run WSUS,...so only the WSUS box needs the
outbound HTTP anonymous access. The other machines get their updates from
that. The only time Clients do it "on their own" is when I rebuild a
machine, I will bring it up to date before deploying it. In that situation
I am just interactively going to Windows Update with a browser. Since that
is working with a user interactively logged in it will work whether it is
anonyous or not because it is based on the logged in user. But even with
all that said,..I can build up a machine, enabled Automatic Updates and let
it sit for a while, running independently of WSUS,...the updates happen.

--
Phillip Windell

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

> > OK. Cure:
> >
> > In client execute proxycfg -p [Isa server name] it then works. Everywhere
> > else i've seen proxycfg -d as the recomendation, but not for me.
>
> Never seen or heard of "proxycfg -p" or "proxycfg -d" in my life,..don't
> even know what it is.

Its one of the useful clues microsoft allow you to have on how your system
works, if you feel like typing a command line to a dos prompt.

>
> I run ISA and all I do is allow outbound http to *.microsoft.com anonymously
> and it "just works".
> No adjustments at all whatsoever on the Clients.
>
> But to give a fuller picture,...I run WSUS,...so only the WSUS box needs the
> outbound HTTP anonymous access. The other machines get their updates from
> that. The only time Clients do it "on their own" is when I rebuild a
> machine, I will bring it up to date before deploying it. In that situation
> I am just interactively going to Windows Update with a browser. Since that
> is working with a user interactively logged in it will work whether it is
> anonyous or not because it is based on the logged in user. But even with
> all that said,..I can build up a machine, enabled Automatic Updates and let
> it sit for a while, running independently of WSUS,...the updates happen.
>

Someone has to be the lucky one that it works for, good job there are only a
few like you otherwise I'd have no job.

A