Ahh Windows updates... Be wary of GPO's and such. While there is a setting to allow 'only administrators' to get prompts to download and install updates, the setting for not auto-rebooting and prompting for user input has nothing to do with admins as I got the joy of learning this morning. A user logged into a terminal server gets the reboot prompt and can restart the server even without reboot permissions since it runs under the auspices of the update client and svchost. Woo Fun!