How to allow Windows Updates when using proxy with authentication?

[FlavioB]

Hello everybody. I got following setup: proxy on the Fortigate with FSSO Authentication (Active Directory based). Now I' d like to have Windows Updates to work without having to pass through authentication. I tried to set the exceptions in the proxy.pac file as follows: if (shExpMatch(url, " www.update.microsoft.com/*" )) { return " DIRECT" ; } Above lines didn' t help at all. Does anybody have any clue about how to get this thing correctly done? Thanks and kind regards, F.

[rwpatterson]

Windows updates require more than one URL:

update.microsoft.com

windowsupdate.com

windowsupdate.microsoft.com Additionally for MS office updates, you could add

office.microsoft.com

[FlavioB]

Hy Bob, thanks for getting back to me. Following are the " exceptions" I pasted into my proxy.pac file: if (shExpMatch(url, " *.windowsupdate.microsoft.com/*" )) { return " DIRECT" ; } if (shExpMatch(url, " *.update.microsoft.com/*" )) { return " DIRECT" ; } if (shExpMatch(url, " *.windowsupdate.com/*" )) { return " DIRECT" ; } if (shExpMatch(url, " download.microsoft.com/*" )) { return " DIRECT" ; } if (shExpMatch(url, " wustat.windows.com/*" )) { return " DIRECT" ; } if (shExpMatch(url, " ntservicepack.microsoft.com/*" )) { return " DIRECT" ; } if (shExpMatch(url, " stats.microsoft.com/*" )) { return " DIRECT" ; } if (shExpMatch(url, " office.microsoft.com/*" )) { return " DIRECT" ; } This didn' t actually help, so I tried following the configuration a colleague of mine did for accessing iTunes Updates bypassing the proxy: he created also " shExpMatch" expressions in the proxy.pac file, but also added a local category to the webfilter profile called " direct-access" and put in there all the listed URLs. After doing this last step, Windows Updates are working again! F.

[rwpatterson]

Glad it' s working. I haven' t messed with pac files since we had Blue Coat half a dozen years back. I forgot most of that stuff. I have only the 4 I posted above in my " Windows Updates" category and it seems to work fine.