The OP's transverse question seems to me to be equivalent to your unasked question #3, and both seem to me to be improperly phrased, because both the adoption of WES 2009, or the spoofing of it, will, at most, accomplish the OS continuing to be patched... but neither can possibly keep *"them"* getting patched!!! However, everybody here (me included) seems to have concluded that the OP really-really meant "the best way to having the OS continue to be patched", so that, if so, question #3 has actually been asked. The answer to #1 is: by creating a full -- known to be good -- backup before every patch Tuesday, so that if anything goes wrong, recovery ought to be easy. And the identification of the problem patch almost as easy. ... Then again, simply by having the backups might actually prevent problems (magically, of course!) because Murphy's law implies that wherever recovery is easy and painless, problems won't ever actually occur!!!