Thanks Jeremy!  A quick update, and hopefully a resolution for our environment, anyway...  During the course of working the support case, our team noticed that the ArcGISUpdate.exe file went from being unsigned to being signed.  Our AppLocker policies allow the Esri-signed file to execute.  So, the issue was resolved locally.  Maybe there are other changes to consider for a more generic fix.