An interesting problem I had a few weeks ago was about an application deployed with ClickOnce; the auto update failed with time out errors even though the updated files could be reached successfully via Internet Explorer. Also, it appeared to be possible for Administrators to successfully auto update the application.
A network trace showed that ClickOnce tried to go out on the Internet to reach the server from where to download from; ClickOnce didn't recognize the proxy settings for the user while Internet Explorer had no problems with that.
After some digging into customer's configuration we found that they were using an IE policy deployed via Active Directory called "NoProxy" where the hosts were separated with commas (”,”) instead of semicolon (”;”). The ClickOnce technology seems to require more stringent proxy setting formatting and did not recognize the commas as separators.