SCCM 2007 R3 SUP - Client Agent Disabled

Hi,
 
I'm a little stuck with the SCCM SUP agent. I recently moved the WSUS role from an existing server to my SCCM server (server 2008 R2).
 
I had success in delivering updates and a SCUP update (Adobe Reader X) to our workstations but some of the workstations seem to be refusing to acknowledge that the Software Updates Client Agent has been enabled.
 
I did have a problem where workstations were being left in provisioning mode but with a little help I found out that I had a problem with my TS. With some registry key tweaks that was solved.
 
The workstations do show the Software Evaluation Cycle & Software Updates Scan Cycle in the control panel but the component is disabled. They also appear to be checking the updates:
WUAHandler.log

Update (Missing): Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008 x86 (KB2600217) (7079beeb-6120-4afd-ad07-fb4dfa284fbe, 100)

 
Could someone point me in the right direction to which logs I should be looking at or some steps to troubleshooting.
 
Many thanks,
 
Scott Menzies
 

The logs I usually look at are (in ccm\logs):  wuahandler.log (that will tell you if a gpo is smacking down your cm local policy), and if scanning is happening correctly, then updatesdeployment.log usually has some gems of info buried in the noise.
Since SUP is as you know based on WSUS, %windir%\windowsupdate.log is quite helpful.
Since you've been apparently using WSUS for a while, I'm sure you are familiar with the tricks of "reinstall the wu agent" or "reregister the dlls" or the "delete the softwaredistribution folder and reregister the dlls" batch files that are out there.
There's also a free tool you can download from http://www.solarwinds.com/downloads/ (near the bottom) for checking the health of your windows update agent. (not strictly for CM alone, but still helpful)
Edit: if the policy from the site is not "making it" to the clients to enable that component (which are are implying) a couple of things to try:  1) do you have multiple primary sites?  If so, you enabled that component at EACH site, not just the top one, right?  2) if you did enable it at all sites... sometimes the policy just needs to get a new "policy version".  One way is to just go into that software updates agent on the primary site(s) and change it a bit... like if you have re-eval every 3 days, change it to daily.  Something, anything, to trigger a new policy version. 

Thanks for your advise.
 
Starting with your edit:
I'm running a single site and I've just change the reevaluate schedule like you said, though it was set for daily but put it to a custom daily.
 
The WUAHadler.log is showing syncs, it shows "Enabling WUA Managed server policy to use server: " then lists if an update is missing or installed already, which I am assuming that part is working.
The UpdatesDeployment.log shows the following:

Service startup system task    UpdatesDeploymentAgent    18/07/2012 11:44:11    2704 (0x0A90)
Software Updates feature is disabled   UpdatesDeploymentAgent    18/07/2012 11:44:11    2704 (0x0A90)
Failed to retrieve current (user,session) pair (0x80070002).    UpdatesDeploymentAgent    18/07/2012 11:44:11    2704 (0x0A90)
::GetSMSConsoleSessionId - No SMS console session found.    UpdatesDeploymentAgent    18/07/2012 11:44:11    2704 (0x0A90)
WTSQueryUserToken[2](SessionID=-1) failed with GLE=1008    UpdatesDeploymentAgent    18/07/2012 11:44:11    2704 (0x0A90)
WTSQueryUserToken[2](SessionID=-1) failed with GLE=1008    UpdatesDeploymentAgent    18/07/2012 11:44:11    2704 (0x0A90)
WTSQueryUserToken[2](SessionID=-1) failed with GLE=1008    UpdatesDeploymentAgent    18/07/2012 11:44:12    2704 (0x0A90)
Error getting logged on user token. Code 0x800703f0    UpdatesDeploymentAgent    18/07/2012 11:44:12    2704 (0x0A90)
No user is logged on    UpdatesDeploymentAgent    18/07/2012 11:44:12    2704 (0x0A90)
Total targeted updates = 0    UpdatesDeploymentAgent    18/07/2012 11:44:13    2704 (0x0A90)
Failed to retrieve current (user,session) pair (0x80070002).    UpdatesDeploymentAgent    18/07/2012 11:44:13    2704 (0x0A90)
::GetSMSConsoleSessionId - No SMS console session found.    UpdatesDeploymentAgent    18/07/2012 11:44:13    2704 (0x0A90)
WTSQueryUserToken[2](SessionID=-1) failed with GLE=1008    UpdatesDeploymentAgent    18/07/2012 11:44:13    2704 (0x0A90)
WTSQueryUserToken[2](SessionID=-1) failed with GLE=1008    UpdatesDeploymentAgent    18/07/2012 11:44:13    2704 (0x0A90)
WTSQueryUserToken[2](SessionID=-1) failed with GLE=1008    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
Error getting logged on user token. Code 0x800703f0    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
Total Pending reboot updates = 0    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
No pending reboot updates at system restart.    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
OnServiceWindowAvailable - No pending install assignment    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
Successfully registered for ServiceWindow Events    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
Successfully registered for TimeChange Event    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
Startup task completed    UpdatesDeploymentAgent    18/07/2012 11:44:14    2704 (0x0A90)
Message received: '<?xml version='1.0' ?><SoftwareUpdatesMessage MessageType='EvaluateAssignments'><UseCachedResults>True</UseCachedResults></SoftwareUpdatesMessage>'    UpdatesDeploymentAgent    18/07/2012 11:44:14    2792 (0x0AE8)
Message ignored as component is disabled.   UpdatesDeploymentAgent    18/07/2012 11:44:14    2792 (0x0AE8)
User logon system task    UpdatesDeploymentAgent    18/07/2012 11:52:41    3148 (0x0C4C)
Cached CCM (user, session) is: (S-1-5-21-1693986677-473501239-621696214-13420,1).    UpdatesDeploymentAgent    18/07/2012 11:52:41    3148 (0x0C4C)

 
I've highlighted a couple of lines as these are what I have spotted on two of my problematic computers, though I am stuck as to what they mean.
 
I'll have a look into the tool and see if that suggests anything.
 
Thank you.
 
Scott
 

OK, having a quick comparison between a test machine (working) and a production computer (non working) the diagnostics all look the same. A warning on Automatic Update: Disabled; options: Not found, there is no such key; an error on: Content: Error: forbidden, SSL implemation or access rights to WSUS server.
 
*EDIT* NO! LIES!
The comparison is not the same, my test machine just picked up new updates and the results of the tool just changed. I had rebuilt the machine this morning and forgot that I had done so.
 
The test results under the Windows Agent configurations settings header changed to no such key for:

• Automatic updates
• options
• use WSUS server
• Windows update server
• WSUS URLs are identical : Values are empty.

I can only assume this is something to do with my GP. When i first started the change from WSUS to SUP I got different info on the use of GP, some said changed them all to not configured and some said put your SUP FQDN.   I tried having it not configured but got error messages in my logs. Also the computers started using Windows Update online and installed IE9 (very very very annoying), luckily it's the school holidays and not that many people are in. Adding the FQDN to the GP worked, or so I thought. ummm?
 
*EDIT 2*
OK, this is getting confusing, it's now got the correct info (URLs) but Automatic Update is now Disabled and Options is Not Found.

I have just completely removed the SCCM client from one of the problematic computers, cleared the registry, removed the CCM & CCMsetup folders, rebooted and then pushed out the client to the computer. It's now doing what it should.

So the question is, am I going to have to uninstall/install the client on the remaining 350 computers? Or am I missing something completely obvious? Is there some further steps I can take to work out if it is the client, registry or cache?