"Thumbs up" to James007
He is correct in that only managed clients can update via GUPs. The content held on the GUPs is cached from the SEPM, meaning only SEPM managed clients can use it (an unmanaged client wouldn't know what to ask a GUP for, even if it knew about them).