I always add myself to each workstation as a local admin (this seems like a good practice for troubleshooting, etc. as well as for updating).  Then if I have to run updates, I do it logged in as myself.  I just have the users log off rather than shut down at the end of the day, then log in as myself and do whatever needs doing.  I try not to do this too often since it's a pain in the neck, and I'm getting close to finding the time to install SUS to take care of most of it.  I like to do most of the install as the primary user of the computer, so I give them local admin rights until the OS is set up, joined to the domain, and the major apps installed, then I tighten up their access.

By the way, Mark makes a good point about software needing elevated rights.  I've given up on "restricted user" for most people, since it seems that many programs complain at that level.  I make almost everyone a "power user."  And, I do tell them I've tightened up the security on the computer and to let me know if they run into any issues as a result.  I don't present this as a user thing, since everyone thinks they deserve the least restrictive security, but rather as general network policy.
 Thanks, Dave.  Using the setup computer wizard in SBS2k, this runs through the login script for the computer regardless of who logs in.  If the person does not have admin rights, the script will not run completely.  I like the idea of just setting the box then change the user rights, but what about updates?

 Thanks, Scott
   "Dave Nickason" <gwdibble@frontiernet.net> wrote in message news:OtbtR%23jSDHA.1576@TK2MSFTNGP12.phx.gbl...
   You can use GPO to assign software to a computer (rather than a user), and it will install at the next login, regardless of the user's rights.  What I do instead is to make them local administrators until the computer is set up with all software installed, then back the rights off to user or power user.  It seems to me that I'm generally happier with the software installs I get that way (for example, I've had strange results installing software using "run as" while logged in with the standard user rights).

     "Scott" <sgrubb@(NOSPAM)aircooled.net> wrote in message news:OBt34mjSDHA.1804@TK2MSFTNGP11.phx.gbl...
     Hello,

     I have been exploring the rights of system users in SBS2k.  By default, each user is to be setup as the administrator of their local machine.  This is done to allow the SBS client installer to push software and settings out to the client computers.

     Well, in a few organizations that I work with, local administrative rights are too much for their users.  Is there a way to ensure server driven software pushes without the users being part of the administrator group on the local workstations?  I've tried it and the login script doesn't have the right to run.

     TIA
     --
     Scott