Have you considered installing your Operating System, then install your AntiVirus/Anti Spyware applications and only then go on the Internet to update Windows??
Try, Allow Logon Locally in the Domain Controller Security Policy. Incidentally, it's not usually a good idea to allow ordinary Users to logon to your Domain Controller.