Welcome to ISAserver.org

Windows Update/ISA not playing friendly

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 General] >> Installation >> Windows Update/ISA not playing friendly

Page: [1]

Message

<< Older Topic Newer Topic >>

Windows Update/ISA not playing friendly - 7.Sep.2005 1:47:00 PM

stormchaser

Posts: 4
Joined: 8.Dec.2004
From: London
Status: offline

Hi,

I'm having problem implementing the Microsoft workaround for the Windows Update issue in KB885819.

I have done the following:

- Created an allow any request to a ôWindows Updateö destination set with all the MS update domains

- Created an "allow any" request to HTTP/HTTPS protocol rule

- Disabled all deny rules

- Unchecked ôAsk unauthenticated users for identificationö on Outgoing/Incoming Web Requests

But we are still receiving authentication prompts which result in 407 errors when we click on cancel. What else can be causing ISA server to deny the requests?

Thanks for any help anyone can give on this.

Post #: 1

Featured Links*

RE: Windows Update/ISA not playing friendly - 7.Sep.2005 2:18:00 PM

LLigetfa

Posts: 2184
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline

My guess is either you are missing something in the destination set or the rules are ordered incorrectly. check the firewall log for what site and what rule is denying, and check the WindowsUpdate.log on the client as well.

(in reply to stormchaser)

Post #: 2

RE: Windows Update/ISA not playing friendly - 8.Sep.2005 5:37:00 AM

stormchaser

Posts: 4
Joined: 8.Dec.2004
From: London
Status: offline

LLigetfa - thanks for the quick reply!

Unfortunately I've had no luck still. I've tried the combinations of

download.micrososft.com
update.micrososft.com
windowsupdate.micrososft.com

with and without the following as a prefix to the domains in a combination of either/or (also tried without them too actually just to cover all options)

"http://"
"https://"
"*."

The other thing is I can find where the order of the rules can be changed in ISA 2004 but I'm unfamiliar with how its done in ISA 2000, am I possibly missing something from my console?

(in reply to stormchaser)

Post #: 3

RE: Windows Update/ISA not playing friendly - 8.Sep.2005 9:54:00 AM

LLigetfa

Posts: 2184
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline

Sorry, I'm on ISA2K4 and forgot everything I knew (which wasn't much) about ISA2000. I have no problem with WU on ISA2K4.

Did you check the log on the client to see what URL is failing and add it to the set? I know I had to go back and forth and keep adding URLs to the point I have 8 of them.

(in reply to stormchaser)

Post #: 4

RE: Windows Update/ISA not playing friendly - 8.Sep.2005 10:36:00 AM

stormchaser

Posts: 4
Joined: 8.Dec.2004
From: London
Status: offline

GOT IT! Thanks for pointing me back to the logs, a good nights sleep and another look helped notice the 12209 error.

I had a Site and Content rule allow rule which was allowing "authenticated users" to all sites AS WELL as my allow rule allowing any request to the Windows Update destination set.

I changed the my authenticated users rule from "All Destinations" to "All Destinations Except Destination Set" and selected the Windows Update dest set I created.

This fixed it. But I still curious about why it denied the anonymous requests.. My understanding was that if it failed a rule that was not a specific deny rule it should continue on until it found a rule that allowed or denied it (ie. my Allow any request to Windows Update rule) and if it doesn't it would then fail and be denied.

[Confused]