The Browser Works Through the Proxy, but Windows Update Fails
Windows Update has its own service context and proxy requirements. A successful browser session does not prove that update downloads have the same route.
A browser success does not test Windows Update's service context. Start with the update error and attempt time, then inspect the relevant route. On systems using WinHTTP, this read-only query is a useful first comparison:
netsh winhttp show proxyCompare the result with the intended managed update policy. A browser account or proxy setting is not automatically suitable for a service.
| Evidence | Investigation |
|---|---|
| Failure to connect to the proxy | Service endpoint and network path. |
| 407 in matching proxy logs | Advertised authentication scheme and account context available to the update component. |
| Denied download destination | Endpoint requirements for the installed Windows release and update arrangement. |
Correlate the attempt with proxy access/authentication records. Microsoft's update troubleshooting guidance also covers WinHTTP and HTTP Range requests; the proxy must support the required operations, not merely load one web page.
Use the supported configuration interface and current requirements for that machine. A historical host list or old proxycfg command is not a complete current policy. Keep update integrity and certificate verification enabled, then confirm the intended update request completes normal validation over the selected route.