A. Windows Update is great for getting the latest fixes; however, you probably want to control change roll-outs, so it's a good idea to stop users from connecting directly to Windows Update. You can do so via a Group Policy:
- Start the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in (Start, Programs, Administrative Tools, Active Directory Users and Computers).
- Right-click the container of the users (a site/domain or organizational unit--OU), and select Properties.
- Go to the Group Policy tab.
- Select the policy and click Edit.
- Expand User Configuration, Administrative Templates, Start Menu & Taskbar.
- Double-click "Disable and remove links to Windows Update."
- Set this policy to Enabled and click OK.
- Close all windows.
Click here to view image