Your examples show you are using the C:, so what is on the mapped drive that needs updating? Have you tried substituting the UNC for the mapped drive letter? Is there no one that can log into the network system as Admin to do the updates for your distributed users?

I don't use Lacerte; I support many QB clients. I like to install for All Users, and set the program icon to Run as Admin. The only issue I have run into is when someone uses the Windows Defender setting for controlling ransomware by setting protected folders. They need to exclude the QB program folders from that protection, or the update fails.

When a program gets updates through the "backside server" connection, it's unlikely you would see ransomware.