In general, you don't do such a thing for any production server environment (whether Windows or not). Instead, engineering specifies a set of versions that work together correctly for the software/application(s) that they want to run on the server, and then the server is configured with those exact versions. Period. Do not auto-update, do not introduce any version changes/updates/patches that have not been properly vetted by engineering first, do not collect $200.
As such, I'd suggest fobbing such responsibility off onto the engineering team. If they want to use an updated version of something, then it is their responsibility to notice that the update is available, test it in their development environment, and certify that it will work correctly with the rest of the server components. To do otherwise invites disaster.