There is a "vault" environment that a server can run in, and it has no access to Windows Update Agent and can only get windows updates directly through WSUS. Is there a way with VBScript to only check for critical updates directly through WSUS and not Windows Update Agent.
Perhaps a note on architecture will help with this. Every system has a Windows Update Agent. It ships with the Operating System. The Windows Update Agent does all of the work, whether it's a home system talking to Automatic Updates, an older system browsing to Windows Update in IE, using the Control Panel WUApp, or talking to a WSUS server -- it's the Windows Update Agent that does the work.
The above script talks to the WSUS server and retrieves information based on what the Windows Update Agent has reported to the WSUS server.
A system that is disconnected, which is what I believe the reference to a "vault environment" is refering to, cannot access AU/WU/MU, but depending on the size of the "vault environment", it is possible to implement a WSUS server within that environment. The WSUS documentation includes detailed instructions on how to deploy and manage a WSUS server in a disconnected network.
If there is no WSUS server in the disconnected network, you can also use the offline scan cab (WSUSSCN2.CAB), but its important to note that this offline file does not contain all updates -- it contains Security Updates, Update Rollups, and Service Packs, so if the desire is to get all Critical Updates, that won't meet the needs.