For the next stage in the lab build, I wanted to look at Windows Server Update Services. This would allow centralised management of the patching process for a growing server estate.
I deployed a new VM from the 2008 R2 template, naming it RSMSGWSUS1. From server manager I went into add roles, then selected WSUS. WSUS requires some IIS components which get selected automatically too.
here. A short while later, all VM's I had domain joined had appeared in WSUS.
update that will appear as needed but never install, and everything was listed as 100%.