Why do client pc's look to internet for updates with sus installed?

[projector1]

I have a win 2000 server running as a dc. It has MS SUS installed and has a test gpo setup. The gpo states the the update services are run from

http://server1

the clients registry also points to

http://server1

as the susserver.
All cleints are xp pro boxes. I have tried changing the name from

http://server1

to the ip address and also the full dns address of the server.

When i examine the results in the windows update text file i get the following entry
2005-01-06 14:15:01-0000 808 32c Service received logoff notification
2005-01-06 14:15:01-0000 808 32c Forwarding control handler info to legacy AU
2005-01-06 14:15:09-0000 808 32c Service received disconnect notification
2005-01-06 14:15:09-0000 808 32c Forwarding control handler info to legacy AU
2005-01-06 14:15:11-0000 808 32c Service received SERVICE_CONTROL_SHUTDOWN control
2005-01-06 14:15:11-0000 808 5f0 Exiting Service Main
2005-01-06 14:15:11-0000 808 5f0 WUAUENG ServiceMain exits. Exit code is 0x240001
2005-01-06 14:15:31-0000 808 5f0 Service Main starts
2005-01-06 14:15:31-0000 808 5f0 Using BatchFlushAge = 5525.
2005-01-06 14:15:31-0000 808 5f0 Using SamplingValue = 619.
2005-01-06 14:15:31-0000 808 5f0 Successfully loaded event namespace dictionary.
2005-01-06 14:15:31-0000 808 5f0 Successfully loaded client event namespace descriptor.
2005-01-06 14:15:31-0000 808 5f0 Successfully initialized local event logger. Events will be logged at C:\WINDOWS\SoftwareDistribution\ReportingEvents.log.
2005-01-06 14:15:31-0000 808 5f0 Successfully initialized NT event logger.
2005-01-06 14:15:31-0000 808 5f0 Successfully initialized event uploader 0.
2005-01-06 14:15:31-0000 808 5f0 Successfully initialized event uploader 1.
2005-01-06 14:15:31-0000 808 5f0 WU client with version 5.4.3790.2182 successfully initialized
2005-01-06 14:15:31-0000 808 5f0 Service status is now SERVICE_RUNNING
2005-01-06 14:15:31-0000 808 620 Successfully opened event cache file at C:\WINDOWS\SoftwareDistribution\EventCache\{F72B8354-3FA7-42A6-B1DB-28A81CD2F6A7}.bin for reading.
2005-01-06 14:15:32-0000 1572 628 Trying to make out of proc datastore active
2005-01-06 14:15:32-0000 1572 628 Out of proc datastore is now active
2005-01-06 14:15:32-0000 808 620 PT: Using serverID {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-01-06 14:15:32-0000 808 620 PT: Using server URL

https://v5.windowsupdate.microsoft.com/ClientWebService/client.asmx

2005-01-06 14:15:32-0000 808 620 PT: Using serverID {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-01-06 14:15:32-0000 808 620 PT: Using server URL

https://v5.windowsupdate.microsoft.com/ClientWebService/client.asmx

2005-01-06 14:15:32-0000 808 620 URL for server is

http://v5stats.windowsupdate.microsoft.com/ReportingWebService/ReportingWebService.asmx

2005-01-06 14:15:32-0000 808 620 Trying to upload 4 events using cached cookie.
2005-01-06 14:16:18-0000 808 5f0 start delayed initialization of WU client
2005-01-06 14:16:18-0000 808 5f0 Client Call Recorder finished delayed initialization
2005-01-06 14:16:18-0000 808 5f0 Setting next AU detection timeout to 2005-01-06 14:16:18
2005-01-06 14:16:18-0000 808 5f0 Launching Legacy AU client
2005-01-06 14:16:18-0000 808 620 Send FAILED with hr = 80072ef1.
2005-01-06 14:16:18-0000 808 620 SendRequest FAILED with hr = 80072ef1. Proxy List used: <(null)> Bypass List used : <(null)>
2005-01-06 14:16:18-0000 808 620 FAILED to upload events to the server with hr = 00000000.
2005-01-06 14:16:18-0000 808 620 FAILED to upload events with hr = 80072ef1.
2005-01-06 14:16:18-0000 808 620 Successfully opened event cache file at C:\WINDOWS\SoftwareDistribution\EventCache\{F72B8354-3FA7-42A6-B1DB-28A81CD2F6A7}.bin for reading.
2005-01-06 14:16:18-0000 808 620 PT: Using serverID {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-01-06 14:16:18-0000 808 620 PT: Using server URL

https://v5.windowsupdate.microsoft.com/ClientWebService/client.asmx

2005-01-06 14:16:18-0000 808 620 PT: Using serverID {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-01-06 14:16:18-0000 808 620 PT: Using server URL

https://v5.windowsupdate.microsoft.com/ClientWebService/client.asmx

2005-01-06 14:16:18-0000 808 620 URL for server is

http://v5stats.windowsupdate.microsoft.com/ReportingWebService/ReportingWebService.asmx

2005-01-06 14:16:18-0000 808 620 Trying to upload 4 events using cached cookie.
2005-01-06 14:17:03-0000 808 620 Send failed with hr = 80072efd.
2005-01-06 14:17:03-0000 808 620 SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)>
2005-01-06 14:17:03-0000 808 620 Failed to upload events to the server with hr = 00000000.
2005-01-06 14:17:03-0000 808 620 Failed to upload events with hr = 80072efd.
2005-01-06 14:21:36-0000 1572 628 Out of proc datastore is shutting down
2005-01-06 14:21:38-0000 1572 628 Out of proc datastore is now inactive

I then ran gpmc to check to see policy settings and they just stated what i had set in the sus gpo.
the ou that the gpo applies to has no other gpo set against it

 

[projector1]

applied this and it solved the proxy issue

Run the following command to add the SUS Server name in the bypass
list for
WinHTTP:
PROXYCFG -d -p < SUS_Server_Name >

but still why is are the cleints looking to the net rather than our sus server

the keys also exist

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
\WindowsUpdate\Auto Update]
"ConfigVer" = REG_DWORD: 0x00000001 (1)
"SusServerVersion" = REG_DWORD: 0x00000001 (1)

 

[projector1]

when i go to