On a Windows 2008 and a Windows 2008 R2 server, I see that an update was installed automatically even though my preferences for Windows updates (on servers) are: "Check for updates but let me decide whether to download and install them".
Well, as justified as this update may be, I was not allowed to decide whether to download and install it or not.
So Microsoft can download and install software on your servers without the system administrators knowing (unless they read the logs, which alerted me to the fact that software was being downloaded and installed, with all kinds of error and warning messages about the non-English versions of the update not being applicable to my machines).
????
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.