Once created a "main" VM we keep it alone to embed Windows updates. Then we clone this into a "service" VM which we convert into a Template to deploy to users. Now, what is the Best Practice to update WIndows OS for the all the users?