Any way to force Windows Update?

Is there a policy or registry entry that I can change to force the users computers in our domain to run and download windows update? Or is there a way that I can turn it on at each workstation, and then prevent user’s from turning it off?