Hello VT,
Glad to help.
According to your description about your environment, I think WSUS could work well, and I recommend you to use WSUS instead of 3rd party tool for security reason.
WSUS is easy to install or use, so there is not much to pay attention to in advance. However, You may want to know the following points.
1> WID or SQL?
Both are fine. WID is free and simple but it may increase the load of local system; Remote SQL could have high availability and high scalability but it may increase the load of bandwidth.
2> Group Policy
You need to use GPOs to control the installation and restart behavior of updates on the client. Refer to following link to create your own policies.
https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/4-configure-group-policy-settings-for-automatic-updates
https://docs.microsoft.com/en-us/windows/deployment/update/waas-restart
3> Test Group
Consider that if you need test group for testing new released updates before approving them to production environment.
4> Do not install WSUS on your DC, and make sure you WSUS server is up to date before deploying updates.
Here are some references may be helpful for you.
Windows Server Update Services (WSUS)
https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus
Install the WSUS Server
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc708515(v%3dws.10)
Hope my answer could help you and look forward to your feedback.
Best Regards,
Ray
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact
tnmff@microsoft.com.
