Well, Microsoft has released the Software Update Services, wich downloads the latest service packs from windows update and after an Admin aprove the updates it installs on the machine you have configured to use SUS on group policy.

It's good because u don't have to download the patchs from the internet to every machine, it installs directly from your server and after you aproved the updates it installs and if necessary reboots the client machines at the time you specified on the policy.

You also have an option of checking the last service pack installed by scripting on the logon script, so if the last patch isn't installed it launchs the install of the patch, but its much more complex and time consuming then SUS.

There is also a way to check and update the client machines through SMS, but I've never check it...

I think Microsoft isn't making a bad job on making available tools to keep windows machines updated, but it's just my 2 cents...