You need to configure the computer to download updates from a local Windows Server Update Services (WSUS) server
You need to prevent all users who are members of a group named Group1 from running Windows Media Player