I added the following to squid.yeslist (external domain table) the four patterns,
1. *.download.microsoft.com
2. *.windowsupdate.com
3. *.windowsupdate.microsoft.com
4. windowsupdate.microsoft.com
With the squid.yeslist regenerated on all four proxy servers, I am no longer prompted for proxy credentials under these two scenaios:
1. Click Start -> Programs -> Windows Update 2. Open IE; Click Tools -> Windows Update
Note that the yeslist and yuklist ACLs are defined in squid.conf to use regular expressions (dstdom_regex) for matching requests against items in the lists. This squid-users mailing list archive entry
(http://www.squid-cache.org/mail-archive/squid-users/200301/0587.html) in combination with the existing acl entries in our squid.conf led me to believe that the patterns above would work.