Enable "Change Membership" on WSUS console

To enable Group Configuration in the WSUS console ("Change Membership" item), you need to Disable the following Group Policy item:

Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update -> "Enable client-side targeting"

Then go into your WSUS Console and choose the "Options" folder and then the "Computers" option.  In there, check the "Use the Update Services console" item and then you'll be able to move the computers around within the WSUS Console.