Conditions:
- Machines that used to run ISA Firewall client
- Uninstallation of ISA Firewall client
- New PROXY settings configured
- SEP 11.5 installed.
Many machines began getting errors in the application logs from Event Source: crypt32, Event ID: 8. The description of the error says “Failed auto update retrieval of third-party root list sequence number from: [more]http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt”.
I eventually stumbled across a few forums that eventually led me towards this issue happening after installing SEP 11.5. What seemed to be happening is that the machines attempted to update its root certificates from Microsoft Update at two hour intervals. The machine will attempt to connect using the SYSTEM account, so it is important that this account also has the correct PROXY settings. It is likely that after removal of ISA Firewall client, the settings for the SYSTEM account were left in the registry pointing to the old PROXY server.
The SYSTEM account can always be found in the registry at HKEY_USERS\S-1-5-18. I found that on machines that were not working, the registry keys under HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings were pointing to the old PROXY script whereas the working ones were pointing to the correct PROXY wpad.dat configuration file. I had to pull the settings from a newer system because this registry key is a binary key, so you cannot simply type the value.
Be sure that the machine also has unauthenticated user access allowed through any web filtering appliance to www.download.windowsupdate.com also.
More information can be found at http://service1.symantec.com/support/ent-security.nsf/854fa02b4f5013678825731a007d06af/1f626f1854285036802574e4002de4c7?OpenDocument