You can use a WSUS, and/or you can try it with WuInstall, it is very effective especially in combination with psexec. You just write a script that executes WuInstall /install on every machine, which gets all the updates currently available (or you can select update with the /match or /severity options)
see WuInstall