This commandline tool will output all updates that have different group approvals (effective).

C:\CompareGroupApprovals.exe /?

Usage: CompareTargetGroupApprovals <XML Output file>

Example output:

<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<UpdateStatus>
    <update updateID="445639a9-add8-4d0f-9df3-1593492292c6" updateTitle="Security Update for Windows XP x64 Edition (KB928255)">
        <ApprovalStatus computerTargetGroup="Clients" approvalAction="Install" approvalInherited="False" approvalDate="18-02-2007 18:01:09" />
        <ApprovalStatus computerTargetGroup="Test Computers" approvalAction="Scan" approvalInherited="True" approvalDate="14-02-2007 00:29:33" />
    </update>
    <update updateID="0c9f4827-4f1e-4563-b557-7431f70dd6ce" updateTitle="Windows Internet Explorer 7.0 for Windows XP">
        <ApprovalStatus computerTargetGroup="Clients" approvalAction="Not approved" approvalInherited="True" approvalDate="" />
        <ApprovalStatus computerTargetGroup="Test Computers" approvalAction="Scan" approvalInherited="False" approvalDate="14-02-2007 07:17:48" />
    </update>
</UpdateStatus>