In our group policy for the domain we have windows firewall disabled as well as automatic updates disabled and manage the updates with another product. If a laptop user logs on with his cached profile he is unable to start these services when off-site. I would like to be able to have our policy work the way it does now when on the domain but have the services automatically start when not logged onto our domain. We plan on moving to an intranet site and use WSUS in the future as well. Is there a way to set the policy to use the intranet site when on our domain and use Windows Update site when not on our domain even if they log on with the cached credentials? I have been looking through the policy and cannot find the settings I need to enable to get this done. If anyone has a similar scenario could you give me a hand?