I was working on a user's desktop this morning and noticed he was using IE8. We have WSUS setup in our office, and he is correctly registered and receiving updates from WSUS. I checked the approved software list, and couldn't find anything other than the IE8 beta (which was not approved). I read online that MS is releasing IE8 for WSUS in July. This brings me to my question: how did he get IE8 installed? I'm positive he didn't manually initiate the installation. This supports the claim that another employee made a week or two ago saying that some of her co-workers mentioned IE8 being installed.

I created a GPO that installs a customized IE8, but it has only been applied to my VM test OU, so I know it hasn't been applied to those users that way.

I'm confused

Has anyone seen this happen before? And does anyone have any ideas?

Look at the WU logs in the Windows directory, as well as the IE8*.log files to see what you can determine. Most of the info comes from there - if it was installed via SUS, it should be logged in the WU logs. If you don't see it there, it was either pushed via GP or manually installed from another source, which the IE8*.log files should tell you (hopefully).