Windows Server 2016 — Windows Update and web traffic fail due to bad proxy PAC settings — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

System updates and outbound HTTPS calls fail due to incorrect proxy resolution.

Environment & Reproduction

Proxy auto-config changed with invalid PAC URL or logic.

netsh winhttp show proxy
reg query 'HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings'

Root Cause Analysis

WinHTTP and user proxy settings diverge, and PAC returns unreachable proxy endpoints.

Quick Triage

Test direct connectivity and compare proxy settings across contexts.

Test-NetConnection download.windowsupdate.com -Port 443
Invoke-WebRequest https://www.microsoft.com -UseBasicParsing

Step-by-Step Diagnosis

Inspect PAC fetch behavior and WinHTTP trace for connection routing.

netsh winhttp show proxy
netsh winhttp import proxy source=ie

Solution — Primary Fix

Reset WinHTTP proxy and apply validated static proxy or direct setting.

netsh winhttp reset proxy
netsh winhttp set proxy proxy-server='proxy.contoso.local:8080' bypass-list='*.contoso.local;'

Solution — Alternative Approaches

Disable PAC for server workloads and manage proxy centrally via GPO.

reg add 'HKLMSoftwarePoliciesMicrosoftWindowsCurrentVersionInternet Settings' /v ProxySettingsPerUser /t REG_DWORD /d 0 /f

Verification & Acceptance Criteria

Windows Update scan succeeds and outbound HTTPS requests return 200 responses.

UsoClient StartScan
Invoke-WebRequest https://api.github.com -UseBasicParsing

Rollback Plan

Reapply previous proxy policy if direct egress is not permitted.

netsh winhttp import proxy source=ie

Prevention & Hardening

Version-control PAC files and test syntax before production publication.

bitsadmin /util /setieproxy localsystem MANUAL_PROXY proxy.contoso.local:8080 ''

Related Errors & Cross-Refs

Related to CRL retrieval failures and package manager download timeouts.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft proxy and WinHTTP troubleshooting resources for server workloads.