I have a script for my automated build which downloads and installs patches - it recognises which downloads are available and only downloads those hasn't got. It then installs all the patches, including those which were already downloaded.

It's designed to bring Citrix servers up-to-date with approved patches before they are released into the farm for end-users, but if it will help and you want to look the code over let me know.

Oddly, this script which has been working perfectly has started mis-behaving slightly since I included Windows 2003 SP1 in the build process. I've found that if I ignore the error first time round and retry the updates at the end of the build process it works fine!? I also need to re-register all the WU DLLs, otherwise even the manual patch update process does not work. I think it's the additional security for DCOM that is causing the problem, but I'm not sure.