These are XP Pro machines in an AD domain, but I don't have domain group policy privileges, just the ability to add, delete and modify objects within my OUs.
Well I would find out who has those privialges and have them add the policy, its takes like 1 min, Then you are set....
OK NVM, I see you are wanting patches, which means probably weekly or at least monthly. We never had a problem with this in our environment. The reason is that we had a WSUS/SMS server and as soon as a computer was detected on the network it would check in and imeddiatly download/install updates behind the scenes, this way it will start before standby goes into effect. The main thing to have this work is to have a laptop user policy set telling your users that they need to hook up to the network every day or at least once week etc. This way they get the updates.
Laptops are tricky and takes a lot of time to ensure your users are always hooking up to the network, the only thing I can say is if you are needing to get these things updated because most of them are way behind then I would create a plan to get them. If you have a WSUS/SMS server setup like I mentioned above then I would contact all users and tell them to bring the laptop in and hook it up. I would then check the status of all those in the morning, come in like an hour before anyone else, and find any that had problems, and work from there. You can use sms reporting tools for this if you have it setup, you should have a system analyst or someone who knows the location of this(ususally a web server) that you can connect to on your network and see all sorts of goodies about the laptops status, e.g. patch history and errors.
*edit* btw I managed and supported over 450 field laptops for a national cable provider, these technicians all had laptops and would come in and get there work and take off, ususally leaving their laptops in their van and never bringing it in to get updated. I was losing a lot of my time and productivity having to make trips to these sights and forcing them to update. We set up a system so that if the laptop was not on the network for 30 days it would lock out the domain user account so they could not use the laptop anymore. This was a pain for a few months as I then had to constantly unlock these accounts for them on a daily basis, but we eventually started tracking the "Repeat" offenders and if they had 2 or 3 consecitive lock outs, meaning they have not hooked the laptop to the company netowrk they would be revoked laptop privilages. This may seem harsh but laptops need to be secured more then desktops, they need the proper group poclisy changes coming down from IT and they need the patches etc. Since they are out in the field they are more prone for theft, lost and tampering.
We also setup and electronic time card, so this made it more likely a laptop user would bring his laptop in to the network so he could fill it out and email every 2 weeks. Eventually after a few months we only had a few computers that were having problems.
All in all this whole things was very enlighting, this process will also show you alot of laptops with serious problems, e.g. ones that are so foobarded they wont even get the updates, ones that have not been updated since xp first came out, ones not even in inventory or thought to be lost or just unknown.
