A few years ago, my team decided that everyone should pay a small fine of $5 into a jar whenever they failed to arrive by 9 AM. As soon as this was decided, I picked up the jar and contributed $50 for 10 days worth of sleeping in as much as I wanted. The only flaw in my plan was stuffing the cash in the jar in front of everyone, because on seeing that the new policy was immediately cancelled by management.

Most of what you did was right, but the administrator account is exactly the one you need Internet Explorer's security settings to be High on. Set it high, and then put the Windows Update site in the Trusted Sites list. I'd also recommend you check out the Microsoft Baseline Security Analyzer. It'll scan the computer and make similar recommendations. Visiting the Windows Update site alone is not enough. http://www.microsoft.com/technet/security/tools/mb sahome.mspx