I am *relieved* to report to everyone that the problem has finally been
resolved. Microsoft Technical Support found the problem was caused by a
missing permission in the default group policy on my domain controller.

On the domain controller:

I didn't take notes for this part, so I don't have all the detailed steps.
(Maybe someone can fill in the blanks.) I had to open a new group policy
window, click on something,  and remove a check mark from a box located in
the top left corner of a particular screen. Apparently removing the check
mark is critical in order for the workstation steps below to work.

1.  Click on Start... Run... MMC.
2.  ???

On the Windows 2000 computers:

*** Make sure the login ID used to login to the computer and to do the
windows update is a member of the computer's local administrators group. ***

1.   Start... Run... SECPOL.MSC.
2.   In the left pane, right click on the domain name.
3.   Click Properties.
4.   Click Local Policies... Local Users and Groups.
5.   In the right pane, scroll down to "Take Ownership".
6.   The Local Settings and Effective Settings columns
    should both have the Local Administrators group listed.
7.   If not, double-click "Take Ownership" and add the
    Local Administrators group. (Only the Local Settings
    box will be checked at this point.)
8.   Exit Sec Pol.
9.   Go back into Sec Pol. The Effective Settings box should
    now be checked.
10.  Exit Sec Pol.
11.  Click Start... Windows Update. Scan for critical
    updates. Downloaded and installed all found.
12.  Restarted the computer.
13.  Click Start... Windows Update. Scan for critical
    updates showed there were none found! (Yeah!!!)

Millie