Running windows update in a domain

I am trying to find a way to keep our workstations current using windows update.

Our current security configuration requires that an administrator log into each workstation and run windows update. with 75 stations this is very time consuming. Is there a way to do this automatically via group policies etc. We do not have any software such as SMS to automate the process

I don’t want to give the users the ability to install any other software, only windows updates.

Thanks for your help