Scripting

If you have a K1000 box - you should use that instead of WSUS for your patching. I can telll you from experience that it works far better to keep your clients up to date. If you do not have a  K1000 - before you create your images to push out to new PC's with your K2000 - change the settings you need for WSUS. Here is the link to Microsoft explaining the WSUS settings...

http://technet.microsoft.com/en-us/library/cc512630.aspx

We use a GPO in the domain for wsus