Thanks BeenThereB4 I've just realised there is a gotcha. Microsoft allow blocking SP2 from "Automatic Updates" and "Windows Updates". But "SUS" is not considered to be either "AU" or "WU". I was hoping to manage the deployment of SP2 via SUS using the temporary block to block all AD OU's then open selected OU's for SP2. Ah well, best laid plans etc,.