We configure the WSUS client on each server based upon what time of day a patch / reboot cycle would be least intrusive. The patch, complete with automatic reboot is done completely by WSUS. On patching day the selected patches are approved on the WSUS serer. Less than twenty-four hours later we're fully patched. If an emergency patch must go out immediately we'll use SMS.

Out of 500+ servers we only manually have to patch about a dozen. These servers tend to have poorly written applications that require special handling prior to and following a reboot.