Intermittent Scan issues for Update Agent

Question

I am having an issue with SUP/WSUS that I am hoping someone can point me on the right direction on..
The environment is:
SCCM 2012 R2 Primary Site Server on Server 2012 R2 Update
SQL 2012 SP1 on Server 2012 R2 Update (standalone server) that houses the SCCM DB and the WSUS DB.  
Software Update Point is on Server 2012 R2 Update (standalone) with WSUS roll installed. WSUS is configured for SSL (with "requires ssl" checked on the role) and using port 8531.
No issues with the SUP install.  The SUP is synchronizing just fine with Microsoft and I am able manage update objects in the SCCM Admin console (create update groups, ADR's, etc.)  
WSUSCtrl.log:
Checking for supported version of WSUS (min WSUS 3.0 SP2 + KB2720211 + KB2734608)
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Checking runtime v2.0.50727... SMS_WSUS_CONTROL_MANAGER
5/27/2014 2:16:03 PM 3304 (0x0CE8)
Did not find supported version of assembly Microsoft.UpdateServices.Administration.
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Checking runtime v4.0.30319... SMS_WSUS_CONTROL_MANAGER
5/27/2014 2:16:03 PM 3304 (0x0CE8)
Found supported assembly Microsoft.UpdateServices.Administration version 4.0.0.0, file version 6.3.9600.16384
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Found supported assembly Microsoft.UpdateServices.BaseApi version 4.0.0.0, file version 6.3.9600.16384
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Supported WSUS version found SMS_WSUS_CONTROL_MANAGER
5/27/2014 2:16:03 PM 3304 (0x0CE8)
Attempting connection to local WSUS server
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Successfully connected to local WSUS server
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
No changes - local WSUS Server Proxy settings are correctly configured as Proxy Name  and Proxy Port 80
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Attempting connection to local WSUS server
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Successfully connected to local WSUS server
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
There are no unhealthy WSUS Server components on WSUS Server SERVER.SUBDOMAIN.DOMAIN.ORG
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
Successfully checked database connection on WSUS server SERVER.SUBDOMAIN.DOMAIN.ORG
SMS_WSUS_CONTROL_MANAGER 5/27/2014 2:16:03 PM
3304 (0x0CE8)
The clients are getting the local policy pointing it to the correct URL.  This is also verified in the log:
LocationServices.log:
Current AD site of machine is EWJ LocationServices
5/27/2014 1:45:41 PM 4236 (0x108C)
Created and Sent Location Request '{3ABC15E0-70D3-4AE6-991C-B6BAF165C808}' for package {729742E6-9B66-4516-8A69-8569560D88C7}
LocationServices 5/27/2014 1:45:41 PM
4236 (0x108C)
Calling back with the following WSUS locations
LocationServices 5/27/2014 1:45:41 PM
4236 (0x108C)
WSUS Path='https://server.subdomain.domain.org:8531', Server='server.subdomain.domain.org', Version='10'
LocationServices 5/27/2014 1:45:41 PM
4236 (0x108C)
Calling back with locations for WSUS request {3ABC15E0-70D3-4AE6-991C-B6BAF165C808}
LocationServices 5/27/2014 1:45:41 PM
4236 (0x108C)
The issue comes into play in the fact that what appears to be about 85-90% of the time, the client scan cycle fails with error 0x80244004.  This is both Windows 7 x86/64 Pro and Windows XP SP3.  The error translates to:
Same as SOAPCLIENT_CONNECT_ERROR - SOAP client failed to connect to the server.
Source: Windows Update Agent
The REALLY bizarre thing is that the OS's are inverted on their failure rates.  Win 7 fails 85-90% of the time, where as Win XP succeeds 85-90% of the time.
We completely rebuilt the SUP Server (including OS and reconfigured it again for SSL) and alas the issue remains.
Here's some snippets from the logs files from a machine when it fails:
ScanAgent.log
Message received: '<?xml version='1.0' ?>
<UpdateSourceMessage MessageType='ScanByUpdateSource'>
<ForceScan>TRUE</ForceScan>
<UpdateSourceIDs>
<ID>{729742E6-9B66-4516-8A69-8569560D88C7}
</ID>
</UpdateSourceIDs>
</UpdateSourceMessage>'
ScanAgent
5/27/2014 1:45:41 PM 4236 (0x108C)
*****ScanByUpdateSource request received with ForceReScan=2, ScanOptions=0x0000000a,  WSUSLocationTimeout = 604800
ScanAgent 5/27/2014 1:45:41 PM
4236 (0x108C)
Sources are current, but Invalid. TTL is also invalid.
ScanAgent 5/27/2014 1:45:41 PM
4236 (0x108C)
ScanJob({DDFF8212-94D4-4BDC-8A47-41E203F6AD79}): - - - - - -Locations requested for ScanJobID={DDFF8212-94D4-4BDC-8A47-41E203F6AD79} (LocationRequestID={3ABC15E0-70D3-4AE6-991C-B6BAF165C808}), will process the scan request once locations are available.
ScanAgent 5/27/2014 1:45:41 PM
4236 (0x108C)
*****WSUSLocationUpdate received for location request guid={3ABC15E0-70D3-4AE6-991C-B6BAF165C808}
ScanAgent 5/27/2014 1:45:41 PM
4236 (0x108C)
Sources are current, but Invalid. TTL is also invalid.
ScanAgent 5/27/2014 1:45:41 PM
2216 (0x08A8)
ScanJob({DDFF8212-94D4-4BDC-8A47-41E203F6AD79}): CScanJob::OnScanComplete -Scan Failed with Error=0x80244004
ScanAgent 5/27/2014 1:45:44 PM
4236 (0x108C)
ScanJob({DDFF8212-94D4-4BDC-8A47-41E203F6AD79}): CScanJob::ScheduleScanRetry- ScanRetry Timer task successfully scheduled. Will wake up in next 1800 seconds
ScanAgent 5/27/2014 1:45:44 PM
4236 (0x108C)
ScanJob({DDFF8212-94D4-4BDC-8A47-41E203F6AD79}): CScanJob::OnScanComplete - Scan Retry successfully scheduled
ScanAgent 5/27/2014 1:45:44 PM
4236 (0x108C)
ScanJob({DDFF8212-94D4-4BDC-8A47-41E203F6AD79}): CScanJobManager::OnScanComplete- Scan has failed, scan request will be pending for scan retry cycle.
ScanAgent 5/27/2014 1:45:44 PM
4236 (0x108C)
CScanAgent::ScanCompleteCallback - failed at OnScanComplete with error=0x87d00631
ScanAgent 5/27/2014 1:45:44 PM
4236 (0x108C)
WindowsUpdate.log:
2014-05-27 13:45:41:482
2956 8a8
COMAPI -------------
2014-05-27 13:45:41:482
2956 8a8
COMAPI -- START --  COMAPI: Search [ClientId = CcmExec]
2014-05-27 13:45:41:482
2956 8a8
COMAPI ---------
2014-05-27 13:45:41:497
936 ed4
Agent *************
2014-05-27 13:45:41:497
936 ed4
Agent ** START **  Agent: Finding updates [CallerId = CcmExec]
2014-05-27 13:45:41:497
936 ed4
Agent *********
2014-05-27 13:45:41:497
936 ed4
Agent  * Include potentially superseded updates
2014-05-27 13:45:41:497
936 ed4
Agent  * Online = Yes; Ignore download priority = Yes
2014-05-27 13:45:41:497
936 ed4
Agent  * Criteria = "(DeploymentAction=* AND Type='Software') OR (DeploymentAction=* AND Type='Driver')"
2014-05-27 13:45:41:497
936 ed4
Agent  * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2014-05-27 13:45:41:497
936 ed4
Agent  * Search Scope = {Machine}
2014-05-27 13:45:41:497
2956 8a8
COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = CcmExec]
2014-05-27 13:45:44:025
936 ed4
PT +++++++++++  PT: Synchronizing server updates  +++++++++++
2014-05-27 13:45:44:025
936 ed4
PT  + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://server.subdomain.domain::8531/ClientWebService/client.asmx
2014-05-27 13:45:44:056
936 ed4
PT WARNING: Cached cookie has expired or new PID is available
2014-05-27 13:45:44:056
936 ed4
PT Initializing simple targeting cookie, clientId = cf0c5d2d-2a04-41a7-8a1b-4182de886397, target group = , DNS name = sccmtstw7x641.subdomain.domain:
2014-05-27 13:45:44:056
936 ed4
PT  Server URL = https://server.subdomain.domain:8531/SimpleAuthWebService/SimpleAuth.asmx
2014-05-27 13:45:44:056
936 ed4
PT WARNING: GetAuthorizationCookie failure, error = 0x80244004, soap client error = 4, soap error code = 0, HTTP status code = 200
2014-05-27 13:45:44:056
936 ed4
PT WARNING: Failed to initialize Simple Targeting Cookie: 0x80244004
2014-05-27 13:45:44:056
936 ed4
PT WARNING: PopulateAuthCookies failed: 0x80244004
2014-05-27 13:45:44:056
936 ed4
PT WARNING: RefreshCookie failed: 0x80244004
2014-05-27 13:45:44:056
936 ed4
PT WARNING: RefreshPTState failed: 0x80244004
2014-05-27 13:45:44:056
936 ed4
PT WARNING: Sync of Updates: 0x80244004
2014-05-27 13:45:44:056
936 ed4
PT WARNING: SyncServerUpdatesInternal failed: 0x80244004
2014-05-27 13:45:44:056
936 ed4
Agent  * WARNING: Failed to synchronize, error = 0x80244004
2014-05-27 13:45:44:056
936 ed4
Agent  * WARNING: Exit code = 0x80244004
2014-05-27 13:45:44:056
936 ed4
Agent *********
2014-05-27 13:45:44:056
936 ed4
Agent **  END  **  Agent: Finding updates [CallerId = CcmExec]
2014-05-27 13:45:44:056
936 ed4
Agent *************
2014-05-27 13:45:44:056
936 ed4
Agent WARNING: WU client failed Searching for update with error 0x80244004
2014-05-27 13:45:44:071
2956 8a8
COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = CcmExec]
2014-05-27 13:45:44:071
2956 8a8
COMAPI  - Updates found = 0
2014-05-27 13:45:44:071
2956 8a8
COMAPI  - WARNING: Exit code = 0x00000000, Result code = 0x80244004
2014-05-27 13:45:44:071
2956 8a8
COMAPI ---------
2014-05-27 13:45:44:071
2956 8a8
COMAPI --  END  --  COMAPI: Search [ClientId = CcmExec]
2014-05-27 13:45:44:071
2956 8a8
COMAPI -------------
2014-05-27 13:45:44:071
2956 8a8
COMAPI WARNING: Operation failed due to earlier error, hr=80244004
2014-05-27 13:45:44:071
2956 8a8
COMAPI FATAL: Unable to complete asynchronous search. (hr=80244004)
Log file for contrast on a client when it works:
ScanAgent.log
Message received: '<?xml version='1.0' ?>
<UpdateSourceMessage MessageType='ScanByUpdateSource'>
<ForceScan>TRUE</ForceScan>
<UpdateSourceIDs>
<ID>{729742E6-9B66-4516-8A69-8569560D88C7}
</ID>
</UpdateSourceIDs>
</UpdateSourceMessage>'
ScanAgent
5/27/2014 1:43:20 PM 4052 (0x0FD4)
*****ScanByUpdateSource request received with ForceReScan=2, ScanOptions=0x0000000a,  WSUSLocationTimeout = 604800
ScanAgent 5/27/2014 1:43:20 PM
4052 (0x0FD4)
Sources are current and valid. TTLs are however, invalid.
ScanAgent 5/27/2014 1:43:20 PM
4052 (0x0FD4)
ScanJob({1BF68613-35BB-4627-A3F3-FCA455547578}): - - - - - -Locations requested for ScanJobID={1BF68613-35BB-4627-A3F3-FCA455547578} (LocationRequestID={F6F11712-31EA-49BF-AD63-FF3FEF1BA29C}), will process the scan request once locations are available.
ScanAgent 5/27/2014 1:43:20 PM
4052 (0x0FD4)
*****WSUSLocationUpdate received for location request guid={F6F11712-31EA-49BF-AD63-FF3FEF1BA29C}
ScanAgent 5/27/2014 1:43:20 PM
3648 (0x0E40)
Sources are current and valid. TTLs are however, invalid.
ScanAgent 5/27/2014 1:43:20 PM
4052 (0x0FD4)
ScanJob({1BF68613-35BB-4627-A3F3-FCA455547578}): Performing Full Scan.
ScanAgent 5/27/2014 1:43:20 PM
4052 (0x0FD4)
ScanJob({1BF68613-35BB-4627-A3F3-FCA455547578}): Scan Succeeded, Resetting Source to Current and TTLs to Valid
ScanAgent 5/27/2014 1:43:35 PM
3648 (0x0E40)
ScanJob({1BF68613-35BB-4627-A3F3-FCA455547578}): CScanJob::OnScanComplete - Scan completed successfully, ScanType=1
ScanAgent 5/27/2014 1:43:35 PM
3648 (0x0E40)
ScanJob({1BF68613-35BB-4627-A3F3-FCA455547578}): CScanJobManager::OnScanComplete -ScanJob is completed.
ScanAgent 5/27/2014 1:43:35 PM
3648 (0x0E40)
ScanJob({1BF68613-35BB-4627-A3F3-FCA455547578}): CScanJobManager::OnScanComplete - Reporting Scan request complete to clients...
ScanAgent 5/27/2014 1:43:35 PM
3648 (0x0E40)
- - Calling back to client on Scan request complete...
ScanAgent 5/27/2014 1:43:35 PM
3648 (0x0E40)
CScanAgent::ScanComplete- Scan completion received.
ScanAgent 5/27/2014 1:43:35 PM
3648 (0x0E40)
I have verified there are no proxy settings on any of these devices by running "Netsh winhttp show proxy"
Current WinHTTP proxy settings:
    Direct access (no proxy server).
Firewall is OFF on both clients and servers.  There are no WU GPO settings applied.
Anyone have any clues on where to look next?  I have been scouring the internet for a couple of days now and seems that all roads with this type of error leads back to a proxy issue, but since no proxy's are in play here, hasn't been of much help.  Still
digging through stuff but if anyone has any pointers on where to look next it would much appreciated!
Thanks,

Answer 1

Found this Technet article: http://social.technet.microsoft.com/Forums/ru-RU/a1c81d16-d5d0-4367-bae6-3338aab0633f/client-updates-failing-windowsupdatelog-0x80244004?forum=configmanagersecurity
I ran a Wireshark trace and received the exact same error on my client.  I have sent this over to the client to take a closer look.  Fingers crossed that this is the issue as it should be a simple fix.  *fingers crossed*