We've encountered this problom so many times that we've decided to go about it in another way, we run scripts from a central point connecting to c$ of a workstation (under an admin context ofcorse) to do this kind of administration. SU is useful but requires a plaintext password so it's a definate NO-NO.

You could even trigger the execution from a loginscript. For example - we have a script that constantly checks an administration pop-account on the email server and executes scripts depending on what mail was received [the good thing about this is that we can execute the most basic jobs with an SMS message from home... *grin*]

Hope this helps.

Ramon