If you have a SonicWALL configured with LDAP + single sign on and content filtering, you may run into an issue where a server is not able to get out to Windows Update.  Using the SonicWALL Directory Connector diagnostic tool, a check on the server’s IP came back with a locally logged on user, specifically “Acronis Agent User” rather than the domain administrator account that was currently logged in.  This local user name was keyed into the SonicWALL’s SSO config under “User names used by Windows services”, which then allowed the Windows Update agent to successfully connect out.