Windows Update Agent fails to detect all updates (WSUS with SCCM)

Howdy

So we have recently integreated WSUS into SCCM 2012, meaning that WSUS updates are now provided through Software Centre instead of through the Windows Update client. This is working as expected.

However, we are utilising Kaspersky Endpoint Security, which has a Software Vulnerability Report function that we are keen to use. This would notify us of any machines that fail to have all their updates installed. This is a simpler interface than using SCCM Reporting. When searching for vulnerabilities, Kaspersky's network agent uses the Windows Update Agent service to check into WSUS for updates. This function isn't working correctly on our clients, as it manages to detect ONE single Windows Update. I have an example transcript taken from the WindowsUpdate.log file below:

========================================================================================

2016-05-25 16:10:37:917 884 7ac Agent *************

2016-05-25 16:10:37:917 884 7ac Agent ** START ** Agent: Finding updates [CallerId = Kaspersky Network Agent]

2016-05-25 16:10:37:917 884 7ac Agent *********

2016-05-25 16:10:37:917 884 7ac Agent * Include potentially superseded updates

2016-05-25 16:10:37:917 884 7ac Agent * Online = Yes; Ignore download priority = No

2016-05-25 16:10:37:917 884 7ac Agent * Criteria = "IsInstalled = 0 AND IsHidden = 0 OR IsInstalled = 1"

2016-05-25 16:10:37:917 884 7ac Agent * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service

2016-05-25 16:10:37:917 884 7ac Agent * Search Scope = {Machine}

2016-05-25 16:10:37:918 3988 d5c COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Kaspersky Network Agent]

2016-05-25 16:10:38:826 884 7ac PT +++++++++++ PT: Synchronizing server updates +++++++++++

2016-05-25 16:10:38:826 884 7ac PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL= http://OURSCCMSERVER:8530/ClientWebService/client.asmx 

2016-05-25 16:10:57:878 884 7ac PT +++++++++++ PT: Synchronizing extended update info +++++++++++

2016-05-25 16:10:57:878 884 7ac PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL= http://OURSCCMSERVER:8530/ClientWebService/client.asmx 

2016-05-25 16:10:57:986 884 7ac Agent * Added update {80FEF50B-F349-4BDC-B781-FF8CD6D913F6}.201 to search result

2016-05-25 16:10:57:986 884 7ac Agent * Found 1 updates and 123 categories in search; evaluated appl. rules of 1372 out of 2495 deployed entities

2016-05-25 16:10:57:988 884 7ac Agent *********

2016-05-25 16:10:57:988 884 7ac Agent ** END ** Agent: Finding updates [CallerId = Kaspersky Network Agent]

2016-05-25 16:10:57:988 884 7ac Agent *************

2016-05-25 16:10:57:990 3988 6b0 COMAPI >>-- RESUMED -- COMAPI: Search [ClientId = Kaspersky Network Agent]

2016-05-25 16:10:57:991 3988 6b0 COMAPI - Updates found = 1

2016-05-25 16:10:57:991 3988 6b0 COMAPI ---------

2016-05-25 16:10:57:991 3988 6b0 COMAPI -- END -- COMAPI: Search [ClientId = Kaspersky Network Agent]

2016-05-25 16:10:57:991 3988 6b0 COMAPI -------------

========================================================================================

As you can see from this transcript only 1 update was found. This was taken from a test machine that was recently built and was missing a large chunk of updates.

We also have in our infrastructure devices running traditional WSUS on a different server (without SCCM), which are reporting in fine and Kaspersky detects missing updates correctly.

We have determined with Kaspersky that the issue lies with the Windows Update agent and not their software. Can anyone advise if the issue is because we are using SCCM for updates (and so the Windows Update agent doesn't perform correctly) or that there is another issue that can be resolved?

Russell