Windows Update on a Domain Controller by a NON Domain Admin

The server in question is a Windows Server 2003 SP1 Domain Contoller

I have a requirement to grant a specific group of individuals the
rights to run Windows Update on a Domain Controller. I do NOT want to
give this group of users "Domain Admin" rights. Ideally, I'd simply
add the users to the "Local Administrators" group on the server in
question, but obviously since it's a "Domain Controller", the "Local
Administrators" group is inaccessable.

I did find KBArticle 888791 which seems to outline some of the rights,
but when I make the changes using GPEDIT.MSC, the user still doesn't
have the required rights. I suspect because either the Domain Policy
or the Domain Controller Policy is over-riding these changes.

I do NOT want to modify the Domain Controller Policy, because I only
want this user to be able to perform updates on this one specific
domain controller.

Any ideas?

Tim