No sleep. Been up beating my head against a wall but finally found some relief.
My lone WS08R2 domain controller/WSUS host was having issues. It would go into perpetual "downloading updates" when doing either manual update check against MS-Updates, but the status always said 0%. I could let it run for days and it wouldn't get beyond that. So I ran across this article, and it helped.
Basically: Stop the BITS and Crypto services, then stop Update Service. Then rename \Windows\catroot2 to catroot2.old and SoftwareUpdates to SoftwareUpdates.old. Then restart the services and run an update check. Ba-da-bing! It worked!
However, I'm still having an issue with the Server Manager failing to display Roles or Features. It tries to enumerate them and fails with a useless error. The Windows Modules Installer service keeps stopping also for no apparent reason. Still digging. But I'm going to bed for now. Screw this.