XP SP1, Windows update error 0x800072F78

For info, none of our XP clients will contect to Windows Update from behind
a bog standard SBS 2000 install (i.e. no specific ISA configurations in
place), post the install of the MS critical security patches in September.
Alternatively, it may be due to MS updates to the XP side of the
WindowsUpdate site following XP SP2 release. The error given is 0x800072F78
and none of the client fixes in the relevant KB article work
(http://support.microsoft.com/?kbid=836985). W2K clients and the SBS server
update just fine.

The KB article does suggest a firewall problem and, indeed, adding a
temporary allow/allow all IP traffic rule in ISA is a workaround.

Any suggestions on a better solution (not involving XP SP2 at present) would
be appreciated (as would an explanation of what got broke in the first
place!)

Many thanks

Andy Sims

SuperGumby
Wed Oct 13 06:33:58 CDT 2004

I _think_ this relates to a couple of files WU wants to get via https.

The jury is still out on what I would recommend as a fix, enabling a rule
similar to yours and disabling when I finish works for me.

"Andy Sims" <Andy_Sims@merlin.local> wrote in message
news:uHQ0cpQsEHA.3884@TK2MSFTNGP15.phx.gbl...
> For info, none of our XP clients will contect to Windows Update from
> behind
> a bog standard SBS 2000 install (i.e. no specific ISA configurations in
> place), post the install of the MS critical security patches in September.
> Alternatively, it may be due to MS updates to the XP side of the
> WindowsUpdate site following XP SP2 release. The error given is
> 0x800072F78
> and none of the client fixes in the relevant KB article work
> (http://support.microsoft.com/?kbid=836985). W2K clients and the SBS
> server
> update just fine.
>
> The KB article does suggest a firewall problem and, indeed, adding a
> temporary allow/allow all IP traffic rule in ISA is a workaround.
>
> Any suggestions on a better solution (not involving XP SP2 at present)
> would
> be appreciated (as would an explanation of what got broke in the first
> place!)
>
> Many thanks
>
> Andy Sims
>
>
>

Andy
Wed Oct 13 09:20:35 CDT 2004

I think you are right: the Windows update log reports as follows:

2004-10-13 14:45:23+0100 1140 410 PT: Using server URL
https://v5.windowsupdate.microsoft.com/ClientWebService/client.asmx
2004-10-13 14:45:28+0100 1140 410 Add header for accept-encoding: xpress
succeeded
2004-10-13 14:45:35+0100 1140 410 Send failed with hr = 80072efe.

so I presume the issue is with the method the new Windows Update software
tries to access the site: it generates exactly the same behaviour as (for
example) the update routines on Adaware or Spybot (i.e. gets blocked by
ISA). I did read up on what was causing the Spybot update blocking a while
back (hence the all/all rule being available on the SBS server) but I've
forgotten the details: something to do with winsocks and proxy clients etc
etc. Should have made some notes!

XP2 rectifies the problem altogether, by the way.

Forgot to mention in the original post that adding "v5" version update sites
to the Trusted Zones doesn't help (the KB article still refers to v4)

Andy

"SuperGumby [SBS MVP]" <not@your.nellie> wrote in message
news:OTAX3hRsEHA.3268@TK2MSFTNGP09.phx.gbl...
>I _think_ this relates to a couple of files WU wants to get via https.
>
> The jury is still out on what I would recommend as a fix, enabling a rule
> similar to yours and disabling when I finish works for me.
>

SuperGumby
Wed Oct 13 09:31:11 CDT 2004

thanks for the confirmation Andy.

"Andy Sims" <Andy_Sims@merlin.local> wrote in message
news:ukWnS$SsEHA.3336@tk2msftngp13.phx.gbl...
>I think you are right: the Windows update log reports as follows:
>
> 2004-10-13 14:45:23+0100 1140 410 PT: Using server URL
> https://v5.windowsupdate.microsoft.com/ClientWebService/client.asmx
> 2004-10-13 14:45:28+0100 1140 410 Add header for accept-encoding: xpress
> succeeded
> 2004-10-13 14:45:35+0100 1140 410 Send failed with hr = 80072efe.
>
> so I presume the issue is with the method the new Windows Update software
> tries to access the site: it generates exactly the same behaviour as (for
> example) the update routines on Adaware or Spybot (i.e. gets blocked by
> ISA). I did read up on what was causing the Spybot update blocking a
> while back (hence the all/all rule being available on the SBS server) but
> I've forgotten the details: something to do with winsocks and proxy
> clients etc etc. Should have made some notes!
>
> XP2 rectifies the problem altogether, by the way.
>
> Forgot to mention in the original post that adding "v5" version update
> sites to the Trusted Zones doesn't help (the KB article still refers to
> v4)
>
> Andy
>
> "SuperGumby [SBS MVP]" <not@your.nellie> wrote in message
> news:OTAX3hRsEHA.3268@TK2MSFTNGP09.phx.gbl...
>>I _think_ this relates to a couple of files WU wants to get via https.
>>
>> The jury is still out on what I would recommend as a fix, enabling a rule
>> similar to yours and disabling when I finish works for me.
>>
>
>