If the WSUS and Extension Pack are running on Windows Server 2008, this is an expected condition. It is due to the interaction of UAC with the authentication process.
1. To faciliate WSUS_only connections from the Extension Pack, some customers have observed success by placing the domain account in the WSUS Administrators group. However, this will not provide authentication for services accessed via WMI.
2. For any services/features accessed via WMI (e.g. Computer Explorer, Managed Computer Inventory), those tasks will require authentication using the local Administrator account.
3. Alternatively -- but of course, not recommended -- you can disable UAC on the WSUS/ExtPack server.
If you are still getting '401' errors with the domain account in WSUS Administrators as well as with the local Administrator account, this suggests an issue with the configuration of IIS, as the local Administrator account most certainly should be able to successfully authenticate. A relevant test is whether the WSUS native console can be connected when logged on with any of these accounts.
Please email your availability so we can set up a GoToMeeting session and investigate further.
Sorry, I should have mentioned this is running on server 2003.
The normal WSUS console is able to connect from both my workstation and on the server itself.
I'll send an email with my availability shortly.
If this is on Windows Server 2003, then UAC is not an issue, of course.
If the WSUS console works perfectly, and no account works from the Extension Pack, most likely this is a misconfigured Credential Ring.
We'll wait for your email.