One of the servers inside your domain should be set up as the WSUS server. Through group policy, you set all computers inside your domain to get updates only fr

One of the servers inside your domain should be set up as the WSUS server. Through group policy, you set all computers inside your domain to get updates only from that server and only approved updates. I have not done network administration in a very long time, so my suspicion is that many of these domain controllers were set up by not very experienced people with not very intelligent bosses thinking that "it was done once, therefore it is done forever".