Maintaining Updates on a few hundred Windows XP system can be a hassle, but if you know how to use command line and script batch files it becomes quite easy to do.  Even during the Windows 95 days, I was used to running things on the Command line.  With Windows NT3.5 and NT4, I had used the Windows Resource Kit and Sysinternals Suites to write batch files and set up tasks to run in the background.

I was first hired to the University to mainly manage Windows laptops. (The job I originally applied for was given to someone else who had more experience on paper.)  I eventually took over managing all the Windows Desktops to maintain and update software.  The previous person also installed a whole bunch of shareware and even some cracked warez on all the Desktops.  I  didn't really know that several of the software was unlicensed and unpaid, until I started looking at the desktops.  The moment I discovered this issue, I immediately replaced all of them with equivalent open source software, and moved quickly to reduce our liability. Anyone could have reported us and we'd be on the hook for possible massive copyright infringement.  I don't know what that previous person was thinking when they did this.

We also did have some expensive licensed software on some systems and I found open source alternatives to reduce our cost. Hummingbird Exceed was one I definitely remember.  I immediately installed putty and Xming on everything and wrote up instructions to on how to use them.  We still had licenses for them, so I kept them for a bit.  Eventually, as people started following the new instructions and our license renewal came up, we were able to remove Exceed, to save money for both us and for students. Even at student rates of just over $100, it was expensive.  This was when books were still under $100.  I also called up Foxit PDF about licensing for their free version and verified that I could install it on all our systems.  I did that for most labs to reduce the size on disk, back when we only had 40GB disks.  That allowed many more user login profiles to exist on the disks.  Unfortunately, some people needed Adobe, because they extended PDF with extra features that weren't  available on 3rd party software.  I had to keep Adobe around in some labs.

I ran scripts to scan the systems and remove all the shareware and warez.  I wrote for loops for each lab to silently install and update all the 3rd party software.  I found a list of silent install switches at wpkg.org.  Back before everyone started using MSI files for standard installs, each package had different switches, and being able to find them in an easy to look up place saved tons of time digging around the software documentation.  There were many in certain groups that used the same installer package, such as InstallShield, which used the same switches, but not everyone used that.  That site was quite helpful for me to write those early silent install scripts.  Now, with everyone finally standardizing on MSI files, the same standard silent install switch is used.  It makes things much easier.

I did initially use Group policy to publish and push out some of the software, but something broke on the domain, and the domain admin didn't know about it until they updated to server 2008 and there were issues preventing the update.  Software was purchased to scan the domain and fix the issues, which eventually fixed Group policy, but by this time I had an easy scripting solution that was already less effort.  I also couldn't publish all the software, because I had to create the MSI packages first.  It was actually more time consuming to create one for each update than just scripting the installs. I had already switched to scripting all software installs, updates, and uninstalls and saved myself a lot of work.

Scripting updates worked great for Desktop systems, especially those joined to the Domain, although it worked even if they weren't joined.  As long as everything was reachable on the Network, I could just use psexec to reach all Windows systems and plink.exe from the PuTTY suite to script all the Unix/Linux/OS X systems from my Windows systems in a batch file.  It's even easier now, ever since Powershell became code complete to manage every aspect of Windows.  The only thing command line isn't good for is viewing another person's desktop, but you can do everything else now with powershell since Windows Server 2012.  Windows 7 Powershell didn't have all the features needed for complete access and control in the beginning.

Windows only sucks because there's too many people using it.  They're the ones clicking the scam and malware links and installing malware and crashing their systems.  I have run Windows without AV and never gotten any viruses, except when I'm purposely testing them.  Since there's people who don't install updates, they've since forced cumulative, monolithic updates.  Those of us who know what we're doing can no longer patch parts piecemeal to avoid a reboot or reduce the total reboot time.  It's an all or nothing endeavor now.