I already done your OPTIONAL suggestion which makes the first suggestion not possible anymore. Deleted the update from the package and from the global list. I expected it to reach the client within minutes, guess not. After a few hours it seems the clients have accepted the new list so I paniced too soon. A bit bizar to be honest because the "Software Updates Client Agent Properties" is set to 7 days.
rdp problem:
We use laptops forced by policy to rdp to a terminal server so they act like mobile thin clients. If you have an rdp-client < version6 the security give som changes in the way they logon.
Like asking credentials before the real rdp is launched
Asking to trust the target pc
...
With 3000 users it would be a disaster if they all start calling the helpdesk to ask why their screens looks different (and trust me they would have killed the support line)