Over the weekend I ran my first broad test of Software Updates. Over half the mahcines returned a "failed to install update(s)" error, status 11751, in my 'States 1 - Enforcement states for a deployment' report.
I've checked a handful of the machines' UpdatesHandler.log and it looks like many of the individual updates did install, all except one. On each of the failed machines' UpdatesHandler log, they show this one failed update:
WSUS update (6f5dc828-0f05-4577-9a8a-74ab1cbe00a9) installation result = 0x80070643, Reboot State = NoReboot
Update execution failed.
It sounds like the deployment shows 'failing' because this one update could not be installed.