The only "dumb" thing I can think of is critical medical equipment being on a network that can hit Windows Update. It is on people Windows for production tasks

The only "dumb" thing I can think of is critical medical equipment being on a network that can hit Windows Update. It is on people Windows for production tasks that may be jeopardized by updates to responsibly handle themselves. I practice what I preach: my video encoder rig lives on a network that explicitly drops connections to Windows Update--but the machine is also firewalled away from the internet at large and only visits trusted websites as part of production tasks. Neither half of this responsibility is tenable without the other. I am expressly not saying that "forcing" Windows 10 updates on users is a good idea--but I'm sympathetic, and I'm not saying it's not--but if you are running something like "critical medical equipment", it should already be incumbent upon you to be doing it right.