I have discovered one of the reasons for the infamous 0x8024502D error for XP workstations that sit behind ISA proxy servers. The best way I can describe this error is as a client side proxy setting incongruency.

Most technical people are familiar with setting up a Windows workstation to use a proxy server. There use to be only one or two settings one had to be worried about. Now, it appears, there are three. The first two are expected and should be well understood. The third setting is unexpected and does not get changed when you make adjustments to the first two.

The first setting required to set up Internet Explorer to use a proxy can be found under the Tools Menu, Internet Options menu pick. Once you have opened up the Internet Options, click on the Connections tab, then click on the LAN Settings Button. Under the Local Area Network screen, make sure the Use A Proxy check box is checked and the Address and Port fields are filled in with your Proxy Server settings.

The second type of proxy service provided by the ISA server is that provided by the ISA firewall client software (sometimes also called winsock services). The use of the firewall client is optional. The ISA firewall client services applications that ignore the IE settings for proxy services, and/or applications that contain their own proxy settings, and/or applications that do not support proxy server settings at all. If you have loaded the ISA Firewall Client, be sure you have enabled it.

The third setting apparently influences the behavior of Windows Update Control. Microsoft has Knowledgebase articles that discuss making changes but their mindset is from a standalone workstation with direct internet access and not the workstations that sit behind ISA firewalls.

It appears that Microsoft has more work to do to synchronize the proxy settings when the user makes changes to the Internet Options proxy settings. Until Microsoft fixes this, the Windows Update service for XP will continue to fail for those users who sit behind an ISA server unless the users implement the work around listed above.