I have a squid proxy server and my clients are running on windows xp. How can I make Windows XP reach the windows update sites through proxy? In short, through the proxy, windows can not download updates. Any advice would be appreciated.

  • It should work fine if your machines have your proxy set in the system proxy settings (Control Panel -> Internet Options). Have you looked in your SQUID logs to see if there are errors? – squillman Sep 22 '11 at 13:39
  • Thanks for quick reply I already have done in internet option but still is not working and I had look in squid logs there is nothing for windows update, in this case what I have to do? Thank you in advance – Fanar ALHAYALI Sep 22 '11 at 13:55
  • Have you investigated WSUS? – Harry Johnston Sep 22 '11 at 21:25
  • Harry the PCs were connected to WSUS on PDC after I have returned back to workgroup. also I have tested new windows installation but can't download the updates. it's really related to proxy setting – Fanar ALHAYALI Sep 23 '11 at 6:24
  • Presumably the machines don't need to use the proxy to access the WSUS server, so if you point them back at the WSUS server and delete the proxy settings (proxycfg -d) they should be fine. – Harry Johnston Sep 25 '11 at 20:46
proxycfg -p <proxy>:<port> <bypass list>

UPDATE: We see

2011-09-23      15:52:23:843     372    11c     Agent     * Access type: Named proxy
2011-09-23      15:52:23:843     372    11c     Agent     * Default proxy:
2011-09-23      15:52:23:843     372    11c     Agent     * Default proxy bypass: *.local;<local>

in Windowsupdate.log, so it's configured to use proxy. Check if proxy is available from updated machine with telnet 3128 and search squid logs, the answer must be there

  • I have already did it but not working because my proxy server has authentication user/pass how can I add them in proxycfg?Thank you in advance – Fanar ALHAYALI Sep 22 '11 at 15:03
  • 1
    proxycfg (or the ServerXMLHTTP API) does not support proxy authentication. Can't you just add an ACL which would allow unauthenticated access to *.microsoft.com or *.windowsupdate.com to your squid config? Would be the easiest route to go, I think. – the-wabbit Sep 22 '11 at 15:26
  • Done but still not working :( what is the next solution? – Fanar ALHAYALI Sep 22 '11 at 16:22
  • Did proxy settings apply correctly? Does proxycfg without parameters display that proxy is used? If yes, check your squid logs, were there any attempts to contact updates site? – Selivanov Pavel Sep 22 '11 at 16:39
  • Yes, I copied the proxycfg setting C:\>proxycfg Microsoft (R) WinHTTP Default Proxy Configuration Tool Copyright (c) Microsoft Corporation. All rights reserved. Current WinHTTP proxy settings under: HKEY_LOCAL_MACHINE\ SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\ WinHttpSettings : Proxy Server(s) : Bypass List : *.local;<local> – Fanar ALHAYALI Sep 23 '11 at 6:26

I added the following lines and it worked great:

acl windowsupdate dstdomain windowsupdate.microsoft.com;
acl windowsupdate dstdomain .update.microsoft.com;
acl windowsupdate dstdomain download.windowsupdate.com;
acl windowsupdate dstdomain redir.metaservices.microsoft.com;
acl windowsupdate dstdomain images.metaservices.microsoft.com;
acl windowsupdate dstdomain c.microsoft.com;
acl windowsupdate dstdomain www.download.windowsupdate.com;
acl windowsupdate dstdomain wustat.windows.com;
acl windowsupdate dstdomain crl.microsoft.com;
acl windowsupdate dstdomain sls.microsoft.com;
acl windowsupdate dstdomain productactivation.one.microsoft.com;
acl windowsupdate dstdomain ntservicepack.microsoft.com;
acl wuCONNECT dstdomain www.update.microsoft.com;
acl wuCONNECT dstdomain sls.microsoft.com;
http_access allow CONNECT wuCONNECT localnet;
http_access allow windowsupdate localnet;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.