Batch Files

Have you looked at Software Update Services?

Check out http://www.microsoft.com/sus for more information. It's a free download from Microsoft and it basically acts like your personal Windows Update server, where you specify which updates are approved.

You can also specify in Group Policy the SUS server name for the Automatic update client on the Windows 2000 and newer clients and it's download behavior.

That would be a much more comprehensive solution for applying patches, without the cost of SMS and without the hassles of trying to update via logon script.

The MSFT website has links to the download, technical walkthrough's and product documentation.

For the mean time with the batch file solution, you might try running the updates from startup scripts rather than logon scripts to ensure that they run under the System context (which is typically as powerful or more so than the Admin account). That will also prevent users from seeing the command window, or being able to close it.

The potential downside to this solution is that it may cause the machine to reboot before the user is able to login if it is forced in the update package, which doesn't cause any technical problems but can generate extra helpdesk calls.

Hope this helps.

Spanky.