Problem is remote users with XP Pro with Citrix access don't need to be local admins nor authenticated locally by AD. They are essentially really powerful thin clients. How do you simply have a user / power user get critical Windows updates?
I'm trying this:
KB article 328010
Logically it seems to be sufficient, and the user experience seems to indicate it will function, but time will be the test.