With updates, you'll be damned if you do and damned if you don't. Our IT department once had a policy of not installing updates. Everything worked fine until the day a trojan got in and spread across the entire network.
On the other hand, I know from personal experience that you shouldn't accept everything Microsoft offers without question. A few years ago, they took it upon themselves to put out a microcode update for Intel processors and, like a fool, I just let it install. Result: my PC flatly refused to run the Windows GUI.
It took a lot of trawling around the internet (after booting from an alternate O/S) to find a way of removing the thing and I wasn't the only one with a problem. It appears that Microsoft never considered the effects of this update on older processors like mine.
I'm setting up a new XP installation right now and, right on cue, the little icon is telling me that updates are available. Included in the list of 'critical' updates are IE8, which I don't want, and that obnoxious little spy, WGA. Needless to say, these will NOT be getting anywhere near my hard disk!
If you have a large number of computers to deal with, I suggest you try out updates on one computer kept for the purpose before you apply them right across your network - and do a Ghost image first.