In an Active Directory domain, which is the preferred method of keeping host computers patched?

WSUS allows administrators to approve, schedule, and deploy updates from a local server to domain-joined hosts via Group Policy, eliminating the need for each machine to contact Microsoft Update directly. This reduces external bandwidth consumption, enables testing before broad deployment, and provides compliance reporting across the domain.

A web caching proxy accelerates access to web content but has no mechanism for managing, approving, or targeting operating system patches to specific hosts.

Configuring Microsoft Update to run automatically on each host removes centralized control, preventing administrators from testing or staging updates before deployment.

Manually downloading hotfixes and service packs daily is operationally unsustainable, error-prone, and provides no centralized visibility or consistency across the domain.