• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1856
  • Last Modified:

Windows Update over SQUID

We have a situation here where computers running Windows 7 or Windows 2008 behind a Squid proxy are unable to connect to the Windows Update service in the Internet. Our linux guys said that the request hits the squid without authentication information, so that it's denied. From the Windows box, we see a box asking for credentials, but none will work. The computers can navigate the internet with no issues using Internet Explorer pointed to the squid box. The problem occurs only when we use the Windows Update control panel applet.

Here is the error found in the Squid log: TCP_DENIED/407 2009 GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab - NONE/- text/html

Do you guys know anything about this issue involving newer versions of Windows? Do you guys know how to fix it?

Linux version: CentOS 5.6 64 bits
Squid version 2.6.STABLE21
Renato Montenegro Rustici
Renato Montenegro Rustici
1 Solution
Tell your liunx guys to read the FAQ on Windows Update

Renato Montenegro RusticiIT SpecialistAuthor Commented:
Thak you for your reply. I'm sending the docs to them. I will get back here soon.
Also you can tell them to adjust their iptables rules to "withelist"windows update sites/urls.
-hope helps
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

If want to improve performance and control on Windows Update, you should consider install/configure wsus service on windows2008 server and then configure the clients to "download" updates from that server over Local Network instead over Internet.

Or you can implement an WSUS. That will allow you to enter the credentials for squid, and will reduce the bandwith. You will also have the choice on what update you install or not.

Renato Montenegro RusticiIT SpecialistAuthor Commented:
We are trying to implement a WSUS, but we are a datacenter and the costumer is willing to pay for an additional hosting. Thank you for the Linux stuff.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now