I have workstations and vpn remote users with laptops. They can't update their virus protection software or other installed software on their machines. The remotes and local workstations are on a windows 2003 server domain with active directory. Can these users still be restricted so they don't delete or cause havoc to their machines the way they are currently, and somehow give them permisssions to update existing software on the machine? (Such as Anti virus, etc..) The workstations are all windows xp.