How to make windows update talk to a remote wsus server, through a proxy.

1 . deploy wsus server address in group policy

2. create isa rule to allow thru http, https and kerberos-sec (udp) to wsus server, all users

3. change winhttp on workstations to use a non-authenticating proxy. e.g. squid.

c:\>netsh winhttp set proxy x.x.x.x:xx

So in order for it to work you have to have to hand a non-authenticating proxy that you can route the winhttp downloads of BITS (background intelligent transfer service) through. I could not get ISA to accept a request with no credentials.