Question : What is the best practice to EXCLUDE vpn clients from using the WSUS?

G'day experts,
 Running Server 2008 standard R2 with WSUS installed. Works great with internal users but we DO NOT want vpn clients to use this feature but rather have their laptops update automatically. Since all of our computers are in one AD container and by applying the WSUS policy to this container it will affect all computers. We're trying to keep it simple and not have to create containers for computers everytime we need to exclude things.
Thanks everyone,
B

Answer : What is the best practice to EXCLUDE vpn clients from using the WSUS?

Download the account lcokout tools from Microsoft;
 http://www.microsoft.com/downloads/details.aspx?familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e&displaylang=en

There's a tool called eventcombMT.exe this comes with a built-in search for account lockouts that will tell you where the bad attempts are coming from. This should be a good starting point...