Microsoft updates will not download properly when using the Web Protection Proxy Services unless the hosts are added to the Trusted Sites list in the service. Microsoft ISA also needs additional configuration for updates (http://support.microsoft.com/kb/885819).

Use the following steps to add the Microsoft sites to the Trusted Sites list:

1. Log on to the Control Console.
2. Click the Web Protection tab.
3. Click Policies.
4. Highlight the appropriate policy and click Edit.
5. Click the Threat tab.
6. Click the Trusted Sites Anti Malware Bypass banner to expand/display the list.
7. Click New.
8. Add the hosts needed to bypass the proxy and save the entries. The following are the hosts listed from Microsoft:
   • download.windowsupdate.com
   • update.microsoft.com
   • windowsupdate.com
   • windowsupdate.microsoft.com
   • ntservicepack.microsoft.com
   • wustat.windows.com

To exempt the hosts at the browser level, use the following format to file the GPO or PAC entries:

• http://download.windowsupdate.com
• http://*.download.windowsupdate.com
• http://download.microsoft.com
• https://*.update.microsoft.com
• http://*.update.microsoft.com
• https://update.microsoft.com
• http://update.microsoft.com
• http://*.windowsupdate.com
• http://*.windowsupdate.microsoft.com
• http://windowsupdate.microsoft.com
• https://*.windowsupdate.microsoft.com
• http://ntservicepack.microsoft.com
• http://wustat.windows.com