Mark i have to agree with Omar on this one... WSUS is excellent and best of all its the right price for the accoutant! WSUS will handle all updates including XP, Office etc etc - it will also roll out the IE7 when released from a central spot in the org. my 2 cents as well! Rob On Thu, October 19, 2006 7:38 am, Omar Droubi said: Correct me if I am wrong - but if the hotfix is assigned to the computer and not the user- it should run as system and not require any elevation. All you would need to do is create the logic for running the hotfix silently and dealing with a reboot as necessary. What do you have against SUS? Actually you should look at WSUS which will do the Office updates as well and give you a centralized console so you can view the status of the update installation. I think this product is great for the price and I would suggest it to any org that does not want to pay for another software solution and does not believe in setting up the workstations to do auto update with auto install. Even if you can get the HF to work in the GPO your reporting is very poor as you would need to run a post script to check or you would need to comb the event logs. If I was you- and you are against WSUS- I would suggest you spend your time trying to figure out how to upgrade all of your workstations to support Microsoft Update and then you can just use a GPO to configure AutoUpdate settings and your done- the Outlook Junk mail filter will be installed automatically. My 2 cents, Omar From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Mills, Mark Sent: Wednesday, October 18, 2006 2:27 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] How to: Installing hotfix with GPO's? OK, I’ve assigned and published a few few apps with .MSI files with no problems to different OU’s. My question today is “what do I need to install a hotfix (without SUS) when creating a GPO to apply it by OU?” I reviewed some of Darren’s past posts and all I see is that the users may need to be admins of their local machine (because with MSI’s you can tell GP to elevate privileges during the install, and other files such as zap/exe, you cannot tell it to elevate privileges). I think I have that correct. The hotfix is an exe file in the download from MS, if you use Winzip to extract it, you have an .msp file along with some others (such as ohotfix.dll, ohotfix.exe, ohotfix.ini) Can I just point to the .exe file to do the install? Do I need to change the extension to a .zap file? Or is there anything special I can do with the .msp file? The file I’m wanting to install is the newest version of Outlook Junk Email filter located at: http://www.microsoft.com/downloads/details.aspx?familyid=5F2E05EE-284D-4BD4-AAD0-CE95375D48CB&displaylang=en If there is already a good web page that details this, just send me the link. Thanks MrMMills