Can't you have an MSI?
Start the Active Directory Users and Computers snap-in.
To do this, click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
In the console tree, right-click your domain, and then click Properties.
Click the Group Policy tab, select the policy that you want, and then click Edit.
Under Computer Configuration, expand Software Settings.
Right-click Software installation, point to New, and then click Package.
In the Open dialog box, type the full Universal Naming Convention (UNC) path of the shared installer package that you want. For example, \file server\share\file name.msi.
Make sure that you use the UNC path of the shared installer package.
Click Assigned, and then click OK. The package is listed in the right-pane of the Group Policy window.
Close the Group Policy snap-in, click OK, and then close the Active Directory Users and Computers snap-in.
When the client computer starts, the managed software package is automatically installed.
Another option is:
- Create a an user with privileges on the machines.
- Install CPAU
Run CPAU with the -enc and -jobs switches (and the admin user) to encrypt the file
"cpau -u domain\pcadmin -p password -ex "setup.exe" -enc -file install.job" - creates job file called install.job to run setup.exe as domain\pcadmin.
Run cpau with -dec -file switches to run setup.exe as saved in the previous step.
cpau -dec -file install.job -lwp