After much frustration

1. reboot
2. reset wsus on client (script), wait for propogation
3. reset ie security settings, resync client
4. reset ie advanced settings, resync client
5. review windowsupdate.log for in-depth troubleshooting