I think this is what you are looking for, but the "Remove access to use all
Windows Update features" setting is available only on Windows XP and is not
present or supported on Windows 2000.
From the SUS Deployment paper
http://www.microsoft.com/windowsserversystem/sus/susdeployment.mspx
If the "Remove access to use all Windows Update features" Group Policy
setting (located in User Configuration\Administrative Templates\Windows
Components\Windows Update) is enabled, Automatic Updates will not notify
that logged-on user. Because this is a user-based value, it makes a local
administrator appear as a non-administrator so that user will not be able
to install updates. With this policy enabled, the Automatic Updates service
still runs, and if configured as such, a scheduled installation can still
occur.
If the "Remove links and access to Windows Update" Group Policy setting
(located in User Configuration\Administrative Templates\Start Menu and
Taskbar) is enabled, then Automatic Updates will continue to work for
updates from your server running SUS. Users with this policy set will not
be able to get other updates from the Windows Update Web site that you have
not approved on your server running SUS. If this policy is not enabled, the
Windows Update icon will remain on the Start menu for local administrators
to visit the Windows Update Web site. This Windows Update icon will allow
local administrative users to install software available on Windows Update
that the Software Update Service administrator has not approved. This
happens even if you have specified that Automatic Updates should get
approved updates from the server running SUS.
Hope this helps,
IBTerry [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
