Windows Update via Proxy

We have a Windows XP Professional Client SP1 and would like to proceed to
automatic updates. The internet connection is granted via a proxy on port
8080. The connection to the update site is correct, but when downloading the
updates, the svchost.exe connects directly to the public ip on port 80. As we
do and will not grant this rights to the clients, the updates cannot be
executed (blocked by our firewall). I was not able to locate the problem, on
other XP clients, the svchost.exe connects correctly through the proxy while
downloading the patchs and update packages. Any idea where I have to search?
Thanks for help.

Are you getting updates via the Windows Update website, or through Automatic
Updates?

If the latter, do you have proxy autodetect implemented in your environment?

Thanks.

Derek

--
This posting is provided "AS IS" with no warranties, and confers no rights.


"stun" <> wrote in message
news:6752CD36-70CC-4D9F-9BD0-...
> We have a Windows XP Professional Client SP1 and would like to proceed to
> automatic updates. The internet connection is granted via a proxy on port
> 8080. The connection to the update site is correct, but when downloading
> the
> updates, the svchost.exe connects directly to the public ip on port 80. As
> we
> do and will not grant this rights to the clients, the updates cannot be
> executed (blocked by our firewall). I was not able to locate the problem,
> on
> other XP clients, the svchost.exe connects correctly through the proxy
> while
> downloading the patchs and update packages. Any idea where I have to
> search?
> Thanks for help.

I do not use Automatic Updates. The proxy is not autodetected, we enter it
directly under the connection settings in the IE. I am able to get the list
of the updates after analyse of my computer; the problem occurs while
downloading the files. Operations before are correctly executed via Proxy and
port 8080 (as defined).

"Derek Cheng [MSFT]" wrote:

> Are you getting updates via the Windows Update website, or through Automatic
> Updates?
>
> If the latter, do you have proxy autodetect implemented in your environment?
>
> Thanks.
>
> Derek
>
> --
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>
> "stun" <> wrote in message
> news:6752CD36-70CC-4D9F-9BD0-...
> > We have a Windows XP Professional Client SP1 and would like to proceed to
> > automatic updates. The internet connection is granted via a proxy on port
> > 8080. The connection to the update site is correct, but when downloading
> > the
> > updates, the svchost.exe connects directly to the public ip on port 80. As
> > we
> > do and will not grant this rights to the clients, the updates cannot be
> > executed (blocked by our firewall). I was not able to locate the problem,
> > on
> > other XP clients, the svchost.exe connects correctly through the proxy
> > while
> > downloading the patchs and update packages. Any idea where I have to
> > search?
> > Thanks for help.
>
>
>

"Stun",

After moving from v4 to v5, the method of delivery of the actual updates
changed. The old method did not carry null authentication at the site and
did not care which proxy you were going out of. It would take the settings
supplied by and set in Internet Explorer. Now that the site has changed
methods, this previously-working solution no longer automatically pulls
settings from Internet Explorer on clients that have proxy servers, and must
be set directly at the command line on those same clients.

Try this (if you know your proxy settings, you can ignore step 1):
1. Open a single Internet Explorer browser and check proxy settings.
a. Click Tools
b. Click Internet Options...
c. When the "Internet Options" window opens, click the "Connections"
tab at the top
d. Click the "LAN Settings..." button
e. When the "Local Area Network (LAN) Settings window opens, verify the
proxy server name and port are correct.
f. Remember the name and port of this proxy server.

2. Open a Command Prompt
a. Click Start
b. Click Run
c. type cmd and press the <Enter> key

3. Set the proxy server explicitly for services
a. At the command prompt, type: proxycfg.exe and press the <Enter> key.
b. Verify that the server is not listed as <null> nor the port listed
as <null>
c. Assuming the proxy information does not match what you have listed
in Internet Explorer, please follow the remaining steps.
d. From the information gathered in step 1 f., type the following:
proxycfg.exe -p (proxy server name)port number)
Example: proxycfg.exe -p MyServerRocks:8080
e. Repeat step 1a, looking to see if the Server name and port match the
entries in Internet Explorer.
f. Once this is correct, open an Internet Explorer window and try
again.

If this still does not work, there is a fix for ISA Server 2000, but of
course you need access:

On ISA Server 2000
- Disable global authentication for web proxy requests
1. Open the ISA Management MMC
2. Select View, then Advanced
3. Expand Servers and Arrays
4. Right-Click on the <Array Name>
5. Select Properties
6. Select Outgoing Web Requests
7. Uncheck Ask Unauthenticated users for identification
8. Click Apply,
9. When prompted, select Save the changes and restart the service(s)
10. Click OK

- Create a destination set for Windows Update domains
1. Expand <Array Name> and Policy Elements
2. Right-click Destination Sets
3. Select New, then click Set
4. Enter "Windows Update" in the Name field, and click Next
5. Click Add
6. Enter *.download.microsoft.com in the Domain field
7. Leave the Path field blank
8. Click OK
9. Repeat steps 4 through 7 for the following domains:
*.windowsupdate.com
*.windowsupdate.microsoft.com
windowsupdate.microsoft.com
10. Click OK

- Create an anonymous Site and Content rule for Windows Update requests
1. Expand Access Policy
2. Right-click Site and Content Rules
3. Select New, then Rule
4. Enter "Windows Update" in the Name field, and click Next
5. Select Allow and click Next
6. Select Allow access based on destination, and click Next
7. In the "Apply this rule to:" drop-down list, select Specified
Destination Set
8. In the Name: drop-down list, select Windows Update
9. Click Next, then click Finish

Please reply back to this thread and let us know how this goes!

Sincerely,

Pat Walters [MSFT]

"stun" <> wrote in message
news:85135DC8-2ED3-4FAE-8964-...
> I do not use Automatic Updates. The proxy is not autodetected, we enter it
> directly under the connection settings in the IE. I am able to get the
list
> of the updates after analyse of my computer; the problem occurs while
> downloading the files. Operations before are correctly executed via Proxy
and
> port 8080 (as defined).
>
> "Derek Cheng [MSFT]" wrote:
>
> > Are you getting updates via the Windows Update website, or through
Automatic
> > Updates?
> >
> > If the latter, do you have proxy autodetect implemented in your
environment?
> >
> > Thanks.
> >
> > Derek
> >
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
rights.
> >
> >
> > "stun" <> wrote in message
> > news:6752CD36-70CC-4D9F-9BD0-...
> > > We have a Windows XP Professional Client SP1 and would like to proceed
to
> > > automatic updates. The internet connection is granted via a proxy on
port
> > > 8080. The connection to the update site is correct, but when
downloading
> > > the
> > > updates, the svchost.exe connects directly to the public ip on port
80. As
> > > we
> > > do and will not grant this rights to the clients, the updates cannot
be
> > > executed (blocked by our firewall). I was not able to locate the
problem,
> > > on
> > > other XP clients, the svchost.exe connects correctly through the proxy
> > > while
> > > downloading the patchs and update packages. Any idea where I have to
> > > search?
> > > Thanks for help.
> >
> >
> >