Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.
However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have not installed. Here is a quick checklist for you to prepare to make your updates go smooth and seamless.
have updates set on the WSUS server to download automatically. What this provides is a minimal amount of administration.
set a group policy for computers on a domain to install and restart in off peak hours daily.
disable the group policy setting “shutdown and install updates” on the shutdown menu, and do not set it to as the default options. You will have a ton of helpdesk calls if you do not do this especially if your users are used to have their PCs on when they come in to work.
build a test group and move your computer into that group. Build an automatic approval rule for updates for test group, and verify you have no issues for a week before you approve for the rest of the company.
I would set the poll rate for minimum of three hours.
stay on top of the updates. Do not go more than a month without checking them.
do not set servers to automatically install the updates, just have them download the updates. Then manually install them during your maintenance cycle. This should get you moving in the right direction.
Some great unknown tips about WSUS, to have updates install immediately set a custom deadline in the past (that is next time you have the client computers to contact WSUS.) Beware if you do this to a large network, users will complain that their systems are running slow.
Materials referenced for this article are listed below.
TechNet - Best practice for WSUS - http://technet.microsoft.com/en-us/library/cc708536(WS.10).aspx
TechNet - Client Behavior with Update Deadlines - http://technet.microsoft.com/en-us/library/cc708585(WS.10).aspx
TechNet - Approving updates - http://technet.microsoft.com/en-us/library/cc708458(WS.10).aspx