>>With servers the most common setting is to notify when updates are available but not install them automatically, as opposed to workstations where automatic installation is the norm.
>
>With dozen of servers, this has to be turned OFF. There are network engineers which are assigned to do that a few times a year and they'll know when is best to apply various sets of updates.
>
>>In that context a yellow shield usually means updates are available but not yet installed.
>>
>>A red shield may have several causes:
>>
>>- Errors or failures with one or more previously installed updates
>>- Inability to contact MS's update servers to check for updates e.g. Internet connection failure
>>- A problem with Windows Update itself
>
>Thanks, I'll have to raise this issue because I have half of the servers with a yellow shield and the other half with a red shield.

Just a FYI, if there are lots of servers and/or workstations at a single site, setting up Windows Server Update Services (WSUS) can make managing updates easier.