>With servers the most common setting is to notify when updates are available but not install them automatically, as opposed to workstations where automatic installation is the norm.

With dozen of servers, this has to be turned OFF. There are network engineers which are assigned to do that a few times a year and they'll know when is best to apply various sets of updates.

>In that context a yellow shield usually means updates are available but not yet installed.
>
>A red shield may have several causes:
>
>- Errors or failures with one or more previously installed updates
>- Inability to contact MS's update servers to check for updates e.g. Internet connection failure
>- A problem with Windows Update itself

Thanks, I'll have to raise this issue because I have half of the servers with a yellow shield and the other half with a red shield.