I ran into an intriguing error last week. The Patchinstall.log file looked a bit like the following:

Trying to call Scan Program ...
Unable to VP cache path, Error return (2) ...
Error in getting the scan program name and command line, Scan will not be called ...
Unable to get path for scan program, Agent will not evaluate software updates

I was trying to push out the fix to the Sasser worm to my laptop (*) and was totally puzzled. After a bit of investigation I tracked this down the fact that the Security Update package targeted our Test machines collection, but my laptop was not a member of it. So I put the laptop into our Test machines collection, re-advertised “Security Update” and then re-advertised the Sasser fix.

And to note, if you want SMS to retry pushing out update, get it to re-advertise what ever packages you make alterations to.

*: I use my laptop as a test bed for roll outs. It's already patched up to the very latest, but if SMS doesn't return successful then I know it's not going to work on a wider scale.