I use the autoit software to launch the application using Windows Runas. I created a domain group called system_support that I add to all local admin groups on our 2k boxes. In the kix script I check the machine but instead of launching the microsoft patch I run the autoit script that calls the the microsoft patch using local admin priviliage. I would like to use the su but I've had trouble with getting it setup right.

Example of my autoit script.

run as domain\\account \\\\server\\share\\app.exe
wait 2000
send password
exit