Thanks GFM
1/. Checked setting in the program. Definately "Manual" (pic_438.jpg).
2/. Only active template is also set to manual (pic_435.jpg).
However, I quizzed the main user and he admitted to poking around in the UI.
By default, the main UI has a big black button labelled 'UPDATE. He clicked on it and was immediately prompted for the 'Authorization' password (which he does not know).
Not intending to cause any trouble, he immediately clicked 'Cancel', well before the 60 second timer completed.
Skeptical, I tried this on an another machine and surprise, surprise. The same thing happened!
This machine too is now in update limbo. (pic_434.jpg,pic_437.jpg).
Seems the update completes in the background despite the user cancelling its 'Authorization'.
Console profile is set to not update the program.
Imagine my surprise today when I find one of our machines telling me Avast needs to restart it!
Further investigation tells me... well, you can read it yourself.
Can you verify after the reboot and waiting for the cloud connection to be established, that the program update settings show as "manual" on the client? If not, I wonder if you have multiple templates that maybe the selected or Parent Settings Template is wrong for particular devices with the symptom (under the device/overview page), or maybe that device isn't really communicating properly at all and hence some of your other issues. I only have the one (default) settings template as I have a very small single site and have not had any machines upgrade on their own.