Ok, the idea you first had is fine. The real issue is your time factor, You will need some software that 'pushes' the updates to the client pcs, instead of the clients asking for updates from time to time. This could be implemented on a time schedule scheme ie daily etc or via the logon scripts within the domain. I would look to SUS for enterprise of around 500+, and if need more functionallity use SMS. So you are on the right track. Just look at the features etc.