I love it when some windows update borkes existing services. Applied a
few that were waiting to run, after the reboot, none of my Sophos
clients can update from my Sophos Console server.

Apparently the update KB973917 blocked http traffic to it & after I
removed that update & rebooted, my Sophos clients are happy again.