Microsoft Updates Client Sync

Question

Hi,
During Software Updates deployment through SCCM, i have set the updates to be only downloaded from local DP and not to go to Microsoft Updates if it doesnt find it on local DP. But some of the users have reported that their system has downloaded stuff from
the internet and it was rebooted as they tried with software center and it failed with it.
I have checked the gpedit.msc setting "Specify Intranet Microsoft Update Service Location" which directs it to our WSUS server.
Under Windows Update in control panel, it shows "Managed by your system administrator"
I randomly logged on to some machines, when logged in, it says, machine/server needs to be rebooted, either postpone or restart now.
How could this be possible when SCCM deployment setting was set to Available for server and for workstations it was required and should have been automatically rebooted.
One thing which is think if someone had manually installed it using Windows Update from control panel. But what could be any other reason ?

Answer 1

Jason,
I have mentioned it does have an entry in registry but not in windowsupdate.log and that too for one particular day.
Let me past my last query again :
In registry,
WUServer and WUStatusserver does have the entry for our WSUS server
but logs for a particular date shows NULL for WSUS entry but for next days, it shows the WSUS server name in windowsupdate.log
As per it, it looks that it didnt go to the WSUS server and went to Automatic Updates for one particular day.
Does it mean, it could have been done manually or is there any other thing we are missing here ?
If your above statement is what it does, i.e 
The WUA doesn't know or care about the deployment, it is simply checking for pending reboots. If an update was installed that requested a reboot, the
WUA will initiate it.
Then making deployments Available will not help i believe ??