I have disabled automatic updates with Group Policy in order to be able to control when clients update. Automatic updates are off and the update path is blank to allow Internet updates. I still have a handful of clients that update automatically. I have checked a few log files in C:\Windows\Temp, and I can see the update happen but I can't find a reason why. There will be a log file with the following lines:

"UpdateTask::AreUpdatesEnabled: Found a Group Policy Setting controlling updates"

"TaskUpdateDetection::TaskTriggerSourceDisabled: Updates are disabled and the update is not user driven"

and then the next log file will show the update happening a few hours later. Does anyone have any ideas on this?