A customer battling automatic proxy configuration issues with ISA/TMG, and PAC/WPAD.DAT pointed me at the following bug:
Which, if I’m interpreting it right, is Closed. In Connect-speak, that would mean “not being worked on”. (If it was, or is, and a newer version fixes this, please let me know).
From the TMG perspective, a possible workaround is to install the firewall client (or TMG Client as it’s known these days) on the client computer, and turn off the proxy settings at the Java level – this allows the TMG Client to transparently authenticate at the Windows Sockets (winsock) level, bypassing the proxy autodetection script entirely.