After virtualising our server infraestructure, in the last two years the number of windows servers has grown from aprox. 20 to 75, mainly by migrating every service of our corporation to his own vm, but we also are deploying new applications that require one or more servers.
In the old times, keeping windows updated take me only 1 hour to do this (boring) task, but now it's coming really time-consuming and also error-prone (too many servers ,some of them are clusters or nbl, and others have services that depends in other servers, that expect the other server is online when it's restarted, so you can't reboot all at one time).
Our workflow is the following:
1- Someone aproves in WSUS the updates of the month after little testing. 2- One time every month, on Friday evening, when almost isn't anyone working, I start the boring task of log in every server, wuauclt /detectnow, click to download updates, click to install, reboot (keeping in mind what other servers are rebooting at the moment), log in again, check if is any pending update after reboot, etc etc.
I searched in internet and I didn't find anything that can help me in this task, I tried to make a c# app that manage all of this without manually login every server, but wuapi.dll is unable to download/install in remote.
So, I think this has to be a common problem, what other people do? As you can expect, we can't leave updates to install automatically or reboot when automatic updates want.