As a home user I understand letting windows run and install updates automatically. However, in the work place could business software and updates collide thus making running them automatically a bad idea or does it depend on setup? Would it just be best to control all updates from the main Active Directory Node and then push them to all the client machines that way?
We manage this pretty closely for our company (1000 people, all PC users) using Windows Server Update Services (WSUS) as @larrymachine mentioned. But in my experience and opinion opinion, if you don't have a lot of custom code integrated with Office, your odds of having an issue with automatic updates is pretty low.
Given the risk of not doing them, I'd rather have them automated and clean up the occasional issue than leave them un-patched.
There is a role to control windows update on a active-directory forest, it's called Windows Server Update Services: http://technet.microsoft.com/en-us/windowsserver/bb332157
If you do not want du use a WSUS (which is probably your best choice anyway) and still are into automating your Windows Update Process (for Updates of Microsoft Software, not third-party software), and you are fit on windows scripting, you can script the update process using the command line tool WuInstall
You just disable automatic update on each machine and call WuInstall on each machie, for example remotely from a central point using psexec for example, you can specify criterias or configuration files in which you specify the updates to be installed - even caching of updates in the local network is possible.
If you are later deciding to use WSUS, you can keep the scripts because WuInstall does not care if it gets the update from Windows Update Site or WSUS, the process stays the same.