How do you effectively use WSUS/Windows Updates in a mobile/laptop environment?

Question

Hey everyone, I have a question about properly using WSUS and/or Windows Update to properly patch laptops. We provide our users with laptops and a large number of them work from home throughout the week. We want to make sure they're being properly updated,
but also make sure we can control what updates are installed on the machines. It's my understanding that it is against the EULA to make a WSUS server available to the outside world. To me, this leaves a weird gap within the Windows Update world where you either
get all updates from Microsoft's servers or you get updates only when you're onsite at your business. 
I found a neat utility graciously created by the developer(s) of ABC-Deploy, called ABC-Update. This provides a utility to install, uninstall, update, or filter out any updates you wish. You can even have it run against your WSUS server. You could create a
script that runs as a scheduled task to run against WSUS when you're onsite (assuming you have a static public IP) or against Microsoft Update (and filtering out the updates using the /K option). Not perfect, but it seems to do an OK job. My worry is the list
of updates you'd have to filter out using the /K option could become rather large.
I was wondering what everyone else does to properly patch their mobile/laptop environments?
If there's no good solution, I'd love to get in contact with someone at Microsoft to work on this.

Answer 1

Do check with MS on that EULA thing. It sounds strange that it is against EULA assuming you require client authentication when accessing published WSUS server. I have also seen several blog posts from MS describing publishing procedure (for example
this one from WSUS support blog)
Otherwise, I'm affraid, there is no "lightweight" way to do this without using third party soft or doing some programming of your own. One option is using System Center Configuration Manager to manage windows updates. It does support management
of clients over internet, but requires deployment of a number of new servers and services in your network. Another option is deploying direct access in your environment to provide client computers with seemless connection to corporate network. In this case
you can use WSUS to manage updates and collect statistic, while clients can be configured to downloads update content from the internet.
Gleb.