Found an interesting issue today. A client of mine had an error and wasn't downloading any mssecure.cab files even though she had a valid client in the collection, and a properly configured advertisement. What was happening was she was getting an error 11454 in her status messages and referenced the LocalSystem account. After a minute or two of thinking, I recalled that she is running a proxy server for access to the internet, and after correcting the security issue (she either adds the computer that was in the collection's AD computer object to allow for internet access, or changes the security context in which the advertisement/program runs under to an account that has internet access), she was able to successfully download and start scanning for updated patches (MS04-40 in particular).