Windows update - set to automatic but still getting the yellow shield / do you want to install. How to automate it?

ON windows XP as part of a workgroup.  Each machine has Windows updates set to automatic.  which is downlaod and apply at 3AM.

So why do we still get the yellow shield and ';you have updates' message?

How do we automate that completely?  

As a side note (not sure if this is part of the problem?) I go to windows update and it wants to install an activex component before the express update scan will run. is that why I am getting the yellow shield?  I say that but I ran the yellow shield, and it installed the malicious apps program for julyh 2008 and seems to end.  now I run windows update manually and it wants to give me SP3.  that's not an automatic rollout, right?  (not yet?).

thanks!