KB2868725 - multiple fails to install on 64 bit Windows 7 Pro Client

[speckytecky]

We have a Lenovo M92Z running 64 bit Windows 7 Pro here that suddenly stopped opening IE. It's in a student group controlled by Sophos and moving it from there to the ordinary Workstation Group saw IE working ok again. The student group does not have a lock down for IE so that's very strange. Then looking at Updates I could see it has little history of MS updates even though they are set to push out from WSUS. It is stalling on update KB2868725 which on manual installs says a restart is needed but the restart then shows it as wanting to install again on shut down.