I've started seeing this issue after migrating from old Server 2008 R2 to new WSUS on Server 2012 R2. I'm noticing that on some security updates (mostly Server 2003 that I've noticed), they're being downloaded after I approve them but they have the Hidden attribute enabled, so WSUS clients can't download them. I can fix this via a simple "attrib -h *.* /s" on the entire WSUSContent folder but I rather not have to do this every month!
The WSUSContent folder is local on the server. I've looked at Application/System event logs and I'm not seeing anything related. Does anyone have any suggestions on where to check?