If you are seeing issues with the "Install Sofware Updates" task in a ConfigMgr task sequence that is being used to build a reference computer image, or if you are deploying workgroup (non-domain joined) machines, you'll need to tweak the task sequence a little to get this to work properly.  The ConfigMgr documentation at http://technet.microsoft.com/en-us/library/bb693951.aspx covers this:

Installation Properties
Site assignment and the default configuration will be automatically specified by the task sequence action. You can use this field to specify any additional installation properties to use when installing the client. To enter multiple installation properties, separate them with a space. If you are installing the Configuration Manager 2007 client on a computer that is a member of a workgroup you must specify a Configuration Manager 2007 server locator point. The server locator point will locate the assigned software packages and updates that will be installed on the target computer.

But the next part that explains exactly what needs to be done may not be completely obvious to you:

Use the following to specify the server locator point for a computer that is a member of a workgroup: Modify the following registry key with the value provided: Registry KeyHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM\SMSSLP Value:SMSSLP=<serverlocatorpointname> For more information about Configuration Manager 2007 client installation properties see, About Configuration Manager Client Installation Properties.

This is really trying to say that there are two potential workarounds for this:

  1. Add "SMSSLP=<serverlocatorpointname>" into the Installation Properties, or
  2. Add a registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM\SMSSLP and set it to <serverlocatorpointname>.

Insert your own SLP server name in place of <serverlocatorpointname> (without the <>).  (Some web references also suggest that it is necessary to set SMSMP, but that shouldn't be required for this.)  The first workaround is the simplest: edit the task sequence and you are done.

Setting the SLP in this manner allows the ConfigMgr client to get the necessary SUP settings so that the "Install Software Updates" step will work.  Normally these would be received via Active Directory GPOs, but since these are workgroup machines, this provides an alternate source.