I have a 2008R2 RDS server with Automatic Updates set to notify. Somewhere along the way the box got checked for "Allow all users to update this computer", which isn't what I want. However, it's done.
Updates ran a few weeks ago and installed. Is there a way to determine which user kicked off the update procedure? I see dates and times in the log, but it only refers to the WU system account and not the original user.