You use WSUS to control your updates and GPO's to control most everything else. It's not hard.