We have a couple of Windows 2012R2 and Windows 2016 servers hosted with Amazon. None of those servers are joined to a domain, they are all separate.
Before we would just install Windows updates as they came out and I would manually set a reboot time through a powershell script.
Now we have quite a few servers and customers so I want to figure out a better policy. Our official policy now is to do a periodic maintenance every Sunday from 1am to 2am following patch tuesday. It's OK if ALL servers are down at the same time.
Now I read about WSUS, but it seems this is just a role a server takes on to delegate windows update processes to other servers, is that correct? Would it handle scheduling and rebooting for me?
Would it be easier to use the Windows Update PowerShell Module and write my own powershell script, which gets scheduled through the Task Scheduler which I deploy manually on all servers?
Are there other options / best practices?