Maybe with a home system, but in business most users don't have local admin rights but the systems are set to allow them to initiate updates, or updates happen

Maybe with a home system, but in business most users don't have local admin rights but the systems are set to allow them to initiate updates, or updates happen the next time the computer boots up from patch tuesday. If an end-user catches an image-based update being deployed, she can just press that hotkey combo and get local admin rights. Scary stuff here for sysadmins until this is patched or some work-around can be implemented. WindowsPE is a whole separate Windows distro and has all its failings and security issues. MS doesn't seem to have hardened it correctly for its update system. This is also why organizations are usually 2-3 years behind Windows versions. Its just too risky to trust MS to get things done on an acceptable level without nearly 3 years of bug squashing and security auditing per Windows version. I've kept my employer on 7 until next year for reasons like these. Considering all the update and security issues with Win10, we might even put this off until 2018.