The command line switches to WUAUCLT — the Windows Update Automatic Updates client — are documented, just not very coherently. There’s quite a few of them, but the only ones I need regularly are the ones to force update checks. They work with Windows 2000 Server and Windows Server 2003, though they make work on other versions.
These checks are typically done when you restart the update service on the client, which can be done manually by restarting the service.
net stop wuauserv
net start wuauserv
Even then, a lot of times I’ll want to verify on the WSUS server that there aren’t any more updates remaining for a particular host; I’m too impatient to wait for a client to report in on its own.
wuauclt /detectnow
The detectnow switch will force a relatively immediate query to the WSUS server to see if there are any updates that are needed. If there are, the yellow shield will appear in the system tray. This is usually pretty quick, within 20-30 seconds.
wuauclt /r /ReportNow
The ReportNow switch will force the client to send updated status to the WSUS server. It may take a minute or two for the server to reconcile and display the updated status.
If things still aren’t working, the Windows Update log can be found at %systemroot%\WindowsUpdate.log. The log file — strangely verbose, for Microsoft — is just text and viewable in Notepad. If the server you’re trying to connect to is crapping out, or your group policy is pointing you to the wrong server, the proof will be in there.