It seems with each new addition to the pr_XP_Hotfixes scan we have a handful of users who will fail the Clean Access scan even though the Windows Update site shows they are up-to-date. We've seen this issue with several different patches on different user machines. If the user manually downloads and installs the update they will pass the scan but there is no way for users to know why they are failing the scan.
Is this a bug with Clean Access?