I just put this together, it seems to work pretty well:
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired" > nul && shutdown -r -t 0
ping 127.0.0.1 -n 61 > nul
Just throw it in a
.cmd file and drop it in Startup folder and run it once.
(I'm not really clear on what OS's support the
/updatenow parameter but it does seem to have an effect on Windows 7.)
I tested patching a Windows 7 VM and it went through the entire sequence (something like 10 restarts?). The only patches that remained were the Malicious Removal Tool (which requires user approval) and 4 updates that are unchecked by default. They are small though, after installing there was a restart and then a couple patches on top and it was done.
It doesn't install optional updates so there were a few of those, small. I installed them manually and there weren't even any patches on top, so all-in-all it was pretty effective for a simple script. When it finally finishes you simply delete the script. I don't know a simple way to detect a complete finish or I'd have it remove/unschedule itself.
I really don't like WuInstall or the VBS/PowerShell scripts floating around as they are all forced to deal with advanced categorical selection of updates that is too complex for this simple goal. There's no simplicity like "Important", "Recommended", and "Optional"; you have to explicitly exclude languages and/or include many different categories and even then it's not quite the same as what you achieve through the traditional install/restart cycle.
To patch more than just the odd system you should of course use a different method, such as deploying an image with WDS, using a slipstreamed install, WSUS, or WSUS Offline Update.