which is one of the things that I am working on now... an automated patch management script that will run as a service that will pull down patches, MSIs, and AV dats and install them without user interaction as long as the PC is on.
with this running correctly, we will no longer need the users to be local admin.
