That is what hasn't been mentioned in this thread. Around half of the Win7 systems I get asked to look at never actually pull updates because it's stuck checking forever. This is due to a WSUS client bug. Fix used to be to take the system offline and instal 3 hotfixes... not user friendly or obvious so it doesn't ever get done by end user.

This wizard should fix it now: https://answers.microsoft.com/en-us/windows/wiki/windows_7-u...