And after a few days of head scratching, of course, it's a stupid thing… Never added the updates package to the DP.

I'm having some difficulty getting the 'Install Software Updates' task sequence action to work when building a Vista master image in ConfigMgr.  I've read some posts indicating that since this is a workgroup machine I need to ensure the SMSSLP gets set on the client.  I've done that via a reg add command in my task sequence and I can see the value in the registry under HKLM\SOFTWARE\Microsoft\CCM\SMSSLP.  The client properties look good.  It shows the proper site name after the deployment.  I can see the client in the proper collection in the console where I have the updates package advertised.

There seems to be some direct correlation between the problem I'm having and the ProtectYourPC setting under OOBE in the Unattend.xml file.  When I have the ProtectYourPC setting at '3' which shuts off Windows Update in the gui, the Windows Update logs are showing me that the updates process seems to be failing because of some sort of lockdown or blockage.  Been experimenting with the other options for ProtectYourPC, '1', and '2'.  These don't seem to be doing it either.  With these set, I'm getting updates to install, but not from my Software Updates package in ConfigMgr.  The Windows Updates logs are showing me that all the installed updates are being downloaded from the Windows Update website at MS, not coming from my DP.  I don't want this as I want to control which updates get applied.  Has anyone else run into this?

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/smslist/

==============
Missed an email? Check out the list archive:
http://myitforum.com/cs2/blogs/smslist/