Looks like Win2K was the culprit. All the w2k boxes had that
check box checked. We removed it and I haven't seen an
"unapproved update" come thru the log since. That should be
a pretty reasonable assumption as the update errors where
about 2-3 minutes apart, and I have seen one in about an hour
since we fixed the win2k.

Thanks for everyones help on this.

Mike
mgcon@getnet.com
http://www.getnet.com/~mgcon
Phoenix, AZ
USA