Gotcha. It sounds like the system *was* able to get in touch with WU and is aware an update is available. But when it tells you so (which can be hours/days after the fact), and you tell it to go ahead and fetch it, there happens to be a connectivity problem *at that time*. Frankly I'd rather have that than Windows detecting an update, and download it without first getting my approval. And least with WSUS, you get the update list, and the server sits on it and will wait indefinitely for you to approve/reject whatever you want. Only when you've approved of an update will the system download it. Then all your clients connecting to your WSUS server will see the updates when the server has them locally. Then maintaining the connection between your server and its clients is something that remains in your control. And that's the key to everything - remaining in control. Back when MS was pushing Windows 7 users *hard* to upgrade to 8 (which I didn't want), or 8 -> 10, the KB article that triggered the full-screen upgrade nag was well-known, so I blocked it from my WSUS server. I've *never* seen those nag screens on any of my machines.
