Contributed By: Cliff Hobbs [MVP SMS]
Reproduced from the Microsoft Software Update Services: Frequently Asked Questions web page:

http://www.microsoft.com/windowsserversystem/sus/susfaq.mspx#top

"If you already had URLScan installed prior to installing SUS and it is set to block all *.exe files, SUS install doesn't change that URLScan setting, so the client computers will not be able to download any of the patches or updates. In order to correct this problem, you need to change urlscan.ini to allow *.exe requests, and then restart Internet Information Services (IIS) or restart the SUS server.

Another common cause of not being able to download updates is when the "server name" entry in the SUSAdmin>Set options page does not match the name specified in the Automatic Updates policy (WUServer)."