>>Ironically, the user of the Windows 7 workstation is the administrator,

Unfortunately being an administrator is different from running as administrator. See http://en.wikipedia.org/wiki/User_Account_Control

"In other words, a user account may have administrator privileges assigned to it, but applications that the user runs do not inherit those privileges unless they are approved beforehand or the user explicitly authorizes it."

IME you have to alter the manifest to explicitly escalate privileges, call your updating exe a name that causes Win7 to escalate regardless, or use some other mechanism to escalate. As I understand it, the only difference for an administrator is that optionally you don't have to enter a password or even see the escalation dialog at all, but escalation still has to take place.