Internet Explorer and Windows Update get their proxy settings from two different places. Thus, this is the kind of setting required to teach Windows Update to use the proxy:
netsh winhttp set proxy the.proxy.server:3128
Also, if one wanted to install and configure squid for their own use in such a role, the default configuration for the Debian Squeeze package is very close. One need only update /etc/squid/squid.conf to add the relevant network address range for the internal network, similar to:
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
…and then allow requests from localnet by uncommenting the following line:
#http_access allow localnet
That was good enough for me.