I have client-side targeting setup to handle some remote workstations on our network. They VPN in from time to time -- so they can hit the internal WSUS server when they are connected.
I essentially want to set their Windows Update configuration via GPO to use internal WSUS, but to download the updates from the internet (Microsoft). I'm assuming this is a very standard configuration, but my clients are still trying to download from the WSUS server. Can I control this?