SCEP 2012 Definitions only updating 50% of servers

Question

Hiya,
We have SCCM 2012 R2 installed with a SUP and use an ADR to deliver Definitions 3 times a day. We're gradually migrating servers from our existing WSUS infrastructure to SCCM for monthly patching/AV defs.
Since 27.04.14 about half the servers (around 200) have failed to update their AV definitions and are stuck on version 1.173.658.0 (the majority, but not all). I've been comparing servers with up to date defs and those without but I can't see why they're
not working. In C:\Windows\CCMcache I just see a folder created for 28.04.14 for the next def but no file in there.
The non-working servers have;
1. The same AM policies applied
2. The same client settings applied
3. They're in the same site/use same DP
4. The same SCEP version (4.3.220.0)
5. The same SCCM client (5.00.7958.1000 - SP2 client)
6. Checked they're in the collection the ADR applies to
7. Log files show they're pointing to SCCM server and have same GPO settings as working servers
8. WUAgent is the same version
I've trawled through the SCCM client logs, used MpCmdRun.exe
-getfiles and looked through those but can't see any errors.
Of note, the WUAHandler.log shows the last update getting installed but then subsequent scans run, complete and there are no further "Update (Missing): Definition Update for Microsoft Endpoint Protection" entries.
Any help gratefully received!
Thanks

Answer 1

Ok still no joy unfortunately.
Checked the CAS/ContentAccess/ContentTransferManager/DataTransferService logs on an updated server and non-updated server and the only difference I see is this on the non-updated server;
DataTransferService.log
QUEUE: Error restarting queued DTS job {0A28D485-63C0-4C43-B942-7ECD4BFAE938}. Code 0x87d00215
QUEUE: Error evaluating DTS job queue. Code 0x87d00215
Error sending callback notification for DTS job {76FF03FC-D576-4F1D-9F6E-0EB7F187A2B7}
Comparing the WUAHandler.logs shows below;
Working;
Successfully completed synchronous searching of updates.
1. Update: 0a5fbcd9-e403-44cd-9fd0-38a2a942d394, 200 BundledUpdates: 1
Update: fa5965dd-4c94-4564-982b-6d1d1dd6e688, 200 BundledUpdates: 0
1. Update (Missing): Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.646.0) (0a5fbcd9-e403-44cd-9fd0-38a2a942d394, 200)
Async installation of updates started.
Update 1 (0a5fbcd9-e403-44cd-9fd0-38a2a942d394) finished installing (0x00000000), Reboot Required? No
Async install completed.
Installation of updates completed.
Non-working;
Successfully completed synchronous searching of updates.
1. Update: 0a5fbcd9-e403-44cd-9fd0-38a2a942d394, 200 BundledUpdates: 2
Update: fa5965dd-4c94-4564-982b-6d1d1dd6e688, 200 BundledUpdates: 0
Update: 484f6b32-9a1f-41b8-9044-d6da29c13279, 200 BundledUpdates: 0
1. Update (Missing): Definition Update for Microsoft Endpoint Protection - KB2461484 (Definition 1.173.646.0) (0a5fbcd9-e403-44cd-9fd0-38a2a942d394, 200)
Failed to find update (fa5965dd-4c94-4564-982b-6d1d1dd6e688) with binary in update collection from WUA. Continuing with download.
Async installation of updates started.
Update 1 (0a5fbcd9-e403-44cd-9fd0-38a2a942d394) finished installing (0x00000000), Reboot Required? No
Async install completed. Installation of updates completed.
I Couldn't find much on the "Failed to find update" error but from this point i don't see any "1. Update (Missing): Definition Update.." entries since 26.04.14 for the non-updating servers, but it does show the async searching and scans
completing.
Also, working machines have 2 or 3 folders per ADR deployment in the C:\Windows\CCMcache containing files called AM_Delta_Patch_1.173.1491.0.exe etc. but non-working ones have folders with one AM_Delta.exe and 5 or 6 empty folders with the same date.
Was thinking i'd locate the old defs in All Software Updates but they only go back as far as defs released on 30.04.14 so am a bit stumped!
Thanks