Dynamic DNS: ACL & TTL

Hello.

My 2 questions regarding dynamic dns update:

1) When installing a BIND name server, you can put an "acl" (access control list) to have a control on which machines can send a "dynamic update" command to the DNS server.
I want the same functionality in microsoft w2k DNS, i.e. "acl", but I failed to figure out how to do it (if it can be done at all), and if not, is there any alternative ?

2) I can successfully update a NS with a new RR. When I do so, I have to give a TTL value. (Lets say I'm using "nsupdte").
I don't understand why the NS still resolve the updated IP, after the TTL value that I gave, is already expired. (e.g. I updated with TTL 30 [seconds] and I tried to resolve the IP after several hours, and still got the IP. I expected not to get an answer, since 30 seconds have already passed since the time I updated the DNS server).
Is there something else that I don't know about TTL ?