> Of them, it can be expected they know what they’re doing, and making the process easier could obviate their job, so I suspect they like the way it is now.

If a Windows Update-type solution could be funnelled through a locally controlled central server for large installs, then the IT department could approve each update, and the local machines would automatically pull them down.

I assume that something like this already exists (even if it's not tied into Windows Update specifically).