Windows update tells proxy servers not to cache its downloads. To get round this in squid, add the following to your acls:

acl windowsupdate dstdomain .windowsupdate.com
never_direct allow windowsupdate

never_direct tells squid to always try to get the object from cache even if the client specifically asks for it.

UPDATE: I found that Microsoft change the updates whilst keeping the old filename, and this will break if you cache the files. So the best solution is to use SUS (Broken link ~~http://microsoft.com/sus/~~).