SUS and off-network notebook users: repoint WUpdate somehow?

[Scott Marquardt]

We have a group policy that points users to our SUS source. However, when
notebook users leave the network and go home, they're not able to connect
to Microsoft's WUpdate source, because of the persistence of the policy.

What's the best practice for resolving this, so that off-network machines
covered by such policies will repoint to Microsoft for updates? The RPC
vulnerability is an obvious reminder that it's not sane to just rely on
"whenever they happen to get back on the network" for updates to be
available.

- Scott

[Don]

Is there a way to manually run the SUS updates once they've been
declined or post-poned? Our laptop users are set to pull the updates
down, but prompt to install them. Unfortunately, we most of the
laptop users chose to post-pone the updates for several days. With
all of the worms out, we're trying to get them to install the patches,
but since the AU icon is no longer in the system tray, I don't have a
place to send them. And since the SUS GPO is over-riding the
Automatic Updates tab, they can't go to the Declined Updates button.

Any suggestions would be appreciated!