"I have found the policy of installing all updates when first setting up a Windows server and then never touching it again to work quite well."

I think you need to reevaluate your policies immediately. Not applying security patching isn't a good policy.