Are you using Enterprise edition? Standard hardware across users? Active Directory to push a standard set of GPOs and registry edits? Most of this stuff shouldn't be that hard to manage if you have an actual environment set up to do so and not a cobbled together unmanaged mess that grew/was built ad-hoc. That said not all of us are lucky enough to have any better than ad-hoc, and Microsoft in their infinite wisdom stopped offering general desktop and server management courses that might teach this shit a few years back.

Beyond that, you should probably hold back non-security patches and updates by a few weeks to a month. That gives you time to test on a pilot machine and identify what new settings you'll have to push to client machines, and time for the internet and MS to find any issues before you have to do so yourself.