WSUS 3.0 from Microsoft. Works reasonably well, just expect your bandwidth to die for a month or so. We have 150 PC's on a LAN, with 10 servers. Two WSUS servers, one a mirror of the other. About 40GB of content downloaded, but once it's all down, you're sorted. Updates happen automatically at a time interval we define, via Group Policy. Automatically download XP SP3 once, and deploy to 150 machines in a single day, minimal work involved. The initial download is so large for us because we are getting updates for Windows XP, Windows 2000, Windows Server 2003, Windows Server 2000, Office 2000, Office XP, Office 2003, and Office 2007. And it gets every single update ever released for each package.