Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a squid proxy server and my clients are running on windows xp. How can I make Windows XP reach the windows update sites through proxy? In short, through the proxy, windows can not download updates. Any advice would be appreciated.

share|improve this question
    
It should work fine if your machines have your proxy set in the system proxy settings (Control Panel -> Internet Options). Have you looked in your SQUID logs to see if there are errors? –  squillman Sep 22 '11 at 13:39
    
Thanks for quick reply I already have done in internet option but still is not working and I had look in squid logs there is nothing for windows update, in this case what I have to do? Thank you in advance –  Fanar ALHAYALI Sep 22 '11 at 13:55
    
Have you investigated WSUS? –  Harry Johnston Sep 22 '11 at 21:25
    
Harry the PCs were connected to WSUS on PDC after I have returned back to workgroup. also I have tested new windows installation but can't download the updates. it's really related to proxy setting –  Fanar ALHAYALI Sep 23 '11 at 6:24
    
Presumably the machines don't need to use the proxy to access the WSUS server, so if you point them back at the WSUS server and delete the proxy settings (proxycfg -d) they should be fine. –  Harry Johnston Sep 25 '11 at 20:46
show 2 more comments

3 Answers

proxycfg -p <proxy>:<port> <bypass list>

UPDATE: We see

2011-09-23      15:52:23:843     372    11c     Agent     * Access type: Named proxy
2011-09-23      15:52:23:843     372    11c     Agent     * Default proxy: 192.168.1.2:3128
2011-09-23      15:52:23:843     372    11c     Agent     * Default proxy bypass: *.local;<local>

in Windowsupdate.log, so it's configured to use proxy. Check if proxy is available from updated machine with telnet 192.168.1.2 3128 and search squid logs, the answer must be there

share|improve this answer
    
I have already did it but not working because my proxy server has authentication user/pass how can I add them in proxycfg?Thank you in advance –  Fanar ALHAYALI Sep 22 '11 at 15:03
1  
proxycfg (or the ServerXMLHTTP API) does not support proxy authentication. Can't you just add an ACL which would allow unauthenticated access to *.microsoft.com or *.windowsupdate.com to your squid config? Would be the easiest route to go, I think. –  the-wabbit Sep 22 '11 at 15:26
    
Done but still not working :( what is the next solution? –  Fanar ALHAYALI Sep 22 '11 at 16:22
    
Did proxy settings apply correctly? Does proxycfg without parameters display that proxy is used? If yes, check your squid logs, were there any attempts to contact updates site? –  Selivanov Pavel Sep 22 '11 at 16:39
    
Yes, I copied the proxycfg setting C:\>proxycfg Microsoft (R) WinHTTP Default Proxy Configuration Tool Copyright (c) Microsoft Corporation. All rights reserved. Current WinHTTP proxy settings under: HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\ WinHttpSettings : Proxy Server(s) : 192.168.1.2:3128 Bypass List : *.local;<local> –  Fanar ALHAYALI Sep 23 '11 at 6:26
show 6 more comments

I added the following lines and it worked great:

acl windowsupdate dstdomain windowsupdate.microsoft.com;
acl windowsupdate dstdomain .update.microsoft.com;
acl windowsupdate dstdomain download.windowsupdate.com;
acl windowsupdate dstdomain redir.metaservices.microsoft.com;
acl windowsupdate dstdomain images.metaservices.microsoft.com;
acl windowsupdate dstdomain c.microsoft.com;
acl windowsupdate dstdomain www.download.windowsupdate.com;
acl windowsupdate dstdomain wustat.windows.com;
acl windowsupdate dstdomain crl.microsoft.com;
acl windowsupdate dstdomain sls.microsoft.com;
acl windowsupdate dstdomain productactivation.one.microsoft.com;
acl windowsupdate dstdomain ntservicepack.microsoft.com;
acl CONNECT method CONNECT;
acl wuCONNECT dstdomain www.update.microsoft.com;
acl wuCONNECT dstdomain sls.microsoft.com;
http_access allow CONNECT wuCONNECT localnet;
http_access allow windowsupdate localnet;
share|improve this answer
add comment

Can you make a proxy exception for update.microsoft.com?

share|improve this answer
    
You are still getting authentication request errors in your logs Fanar.. you need to add an authorization exception for windows update, just like Quinten said. –  Grizly Oct 30 '12 at 4:53
    
acl byPassAuthMicrosoft dstdomain .microsoft.com, then add http_access allow all byPassAuthMicrosoft before the auth rules –  Grizly Oct 30 '12 at 4:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.