Installing/Updating .Net application using Windows Installer on workstation that restricts any installation by group policy

Why don't you use ClickOnce Deployment ?
http://msdn.microsoft.com/en-us/library/t71a733d(v=vs.80).aspx

Some command line examples:

http://social.msdn.microsoft.com/Forums/en/vbgeneral/thread/5c1262d5-2e85-4fb3-a3be-6fb7259500b4#e5739df4-d35e-4a06-ad09-fc2a27e30759

ClickOnce is a good idea, it doesn't always fit your needs though.

I would re-build the MSI for the updated version of your application, your IT group should be able to deploy automatically via Group Policy (make sure the Upgrade Code is the same for each version of the MSI, and that the Product Code is different).  Or, if they really want to they can manually log into every workstation.  MSI's that have been "pushed" to users or computer via Group Policy will install with elevated rights, the only other way - to my knowledge - is to login as an administrator and run the install.

Is it possible for your application to run per-user (i.e. is it okay for each user to have a copy of the program installed in their profile directories, or does it absolutely need to be installed once in a common location, e.g. C:\Program Files)?

ClickOnce the best

ClickOnce is not the best. It can be a good option in some circumstances (and it seems like it might be a good idea in this particular case), but if you need to do something like control what directory your application is installed in then ClickOnce is no good.

ClickOnce the best solution for this question needs
Who asked about the advantage or disadvantage

I agree ClickOnce might very well work in this particular case, I just wanted to clarify that it is not always "the best." Plus, it might not work at all for the asker - what if his IT group wants to control which computers or users the application is distributed to using Group Policy? ClickOnce won't work in that situation.  To be honest, we haven't really been given enough information to say whether or not ClickOnce is a good idea or not.  What we do know is that an MSI-based installation will work for the asker, since that's what he's using now.

I have not used ClickOnce before but will look into its functionality.  It may work for me.  
I believe updates being pushed by Group Policy won't work in our case because employees who work out of the office for weeks (or months) on end with their laptops (which I was told prevents pushing apps if they don't login to the domain).  
Also based on the answers above (given my original question) can you confirm there is no way to "sign" an application so that group policy allows standard installation/updating with MSI on restricted computers?

Thanks for all the responses - this has been very helpful.