Wierd policy/security issue

[dynasis]

I have a client situation where no one seems to be able to install windows updates on their PC's that are joined to the domain. They can download them just fine but they fail during install. The only way to install them is to log in using the administrator account to the domain.
One user even has domain admin rights but he's still unable to install the updates. I thought it might be a policy issue and others are saying internal DNS. I have searched and searched but I'm unable to find anything to go with that will resolve this issue.
At first I thought it might have been an issue with a users machine but when I tried to run system restore under his credentials (local admin, domain admin) I got a message that he didn't have the appropriate rights to perform this action. I could only run it from the administrators (domain) account.

Maybe a policy has been applied? If so I can't find it.

The PDC is a 2000 server..

Thank you in advance for any help.

Jeremy Johnston

 

[porkchopexpress]

Is it possible that someone has applied the restricted groups policy and this might of removed all local admins?

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

Do you get any errors in the event log when the updates fail to install.

 

[dynasis]

Thanks, I'll check that link out this week and no I do not get any errors. I do get an error when I click on the security log though and states I don't have permission to view it.