Troubleshooting Automatic Update Client starts from WindowsUpdate.log file
Whilst troubleshooting Automatic Update Client for Critical Security Updates, the best troubleshooting starts from WindowsUpdate.log file (%systemroot%\WindowsUpdate.log). Here is how you read the WindowsUpdate.log file
How to read the WindowsUpdate.log file;
http://support.microsoft.com/default.aspx?scid=kb;en-us;902093