I eventually ran the problem down to installer cruft -- mainly network filters the VPNs left in my registry and drivers that were almost perfectly compatible with others already in the system.
(A Windows driver that's almost perfectly compatible is the best way to turn a nicely running laptop into Chernobyl, in case you're looking for a way to explain it to an end user. I got that comparison from the funniest, most bitter user-support person I ever worked with, and never forgot it.)
None of Microsoft's native troubleshooters can identify the problem; resetting winsock, running sfc /scannow didn't do it; system restore wouldn't work; Windows Update fried itself.
All the apps were easy to find, easy to install, and mostly free, at least to install.
And they were all low-level system components, not the much simpler, higher-level games, collaboration apps or UI tweakers end users tend to play with, and which are a lot easier to fix.
So brace yourself as you get farther into the era of bring-your-own-device and public awareness of how exposed a road warrior with a laptop is in a Starbucks.
As users take steps to protect themselves, they're going to take up more of your time and cause you more headaches than ever before. And they'll be doing it to respond to your warnings, so you may not even be able to blame them for trying.
Go ahead and do it anyway.