The issue is a little hard to accurate articulate in the title.
Background: I'm setting up a WSUS hierarchy for a client (but starting with one server first).
There are thousands of updates to approve, obviously, so I've approved all Windows updates from XP to 8.1/2012 R2. I believe I had declined all superseded updates
Issue: When a newly created Windows 7 computer registers with WSUS and downloads/installs the updates, it fails on some of them. After a reboot, more patches are found and installed, and sometimes errors occur. After maybe 4 or so cycles of this, it's fully patched without errors. In other words, there does not appear to be persistent failures of patches, and ultimately, the computer is fully patched with no errors remaining.
If another new computer is left to update entirely from Microsoft, however, the errors do not occur at all.
I'm fairly certain this is just because the updates fed by WSUS include conflicting or superseding updates that may have either become obsolete as another patch was installed, or required a reboot first. On the other hand, I would think that WSUS might be smart enough to offer just those patches that are needed (after evaluating the set of needed patches).
Can anyone offer any insight or point me to information that might explain the difference? I don't feel it's an issue, but the client doesn't want to see the failures.