I moved this provisionally to Business > General Discussion for better handling, since you mentioned a company's machines.
If this had been the consumer side I would have said at least disable the antivirus on all machines before trying but preferably uninstall the software until the upgrade is complete, then reinstall.
Situations differ but the above is what is recommended although I personally only disabled the A/V for my own upgrade.
Let's see what people say on the Business side.
Most likely this is Access Protection inVSE blocking the Microsoft Update process. Moved to product specific forum for better response.
McAf33 Volunteer Moderator - Business Products
Check in the Access Protection log on the client machine to see what rule is being triggered. Then, you will have to modify the VSE policy to exclude that process, or allow that particular action, at least temporarily. I am guessing it is a rule related to scripting, such as "Prevent execution of scripts from the Temp folder."
Marking this as 'Assumed Answered' and locking it. As it is over 2 years old.