I manage quite a few AD networks for clients, all SME sizes and have done this since the w2k days. At one of them I've just seen something I cannot explain at all.
We have two policies defined for WSUS, one for servers one for client PCs. The server policy is applied to the sub sub OU for servers and the client policy is applied to the sub sub OU for PCs. Neither is applied in any other part of the AD tree. Pretty simple.
We had a problem with WSUS on the servers which was caused by both policies being applied to some (maybe all - I didn't check) of the servers.
Opening the client PC policy, the tab which indicates where it is being used showed only the OU containing PCs... so no mistakes with applying it to the root or anything similar.
I picked one server and concentrated on that to try and work out why the client PC policy and server policy were both being applied to it (according to gpresult /d)
gpupdate /f made no difference, neither did rebooting.
I tried creating a new OU and moving the server to it. The result (after a gpupdate) was that the server policy disappeared from gpresult as expected, but the client pc policy continued to be applied.
I edited and renamed the client pc policy just to make sure I wasn't mistaken and to refresh the policy - no effect.
I tried a few more things over the course of a couple of hours but In the end I had to delete the policy to stop it from being applied. It was a simple policy so this was faster, but now my curiosity has been piqued.
How on earth could this policy have been applied to several nodes without it appearing in the appropriate OU tree in the GPO editor? A bug seems unlikely, so there has to be some functionality there that I've never noticed.
All machines involved are running win2008r2, the dcs included.