Your best friends ... uncomment the one you need.
# Debug information on rules.
# debug_options ALL,1 33,2
# Even more detailed information on rules
# debug_options ALL,1 33,2 28,9
Second... SQUID cannot act as a transparent proxy with NTLM authentication... are the XP machines being authenticated ("single-signed-on") with SQUID? is the 80 port traffic redirected to squid?
Key here is to know the configuration you have, without it it's hard to give any advice.