Patch machines during deployment with MDT 2010
In MDT 2010 you can enable two settings that during deployment of your machines will patch them automatically using a WSUS server of your choice.
Take a look at your existing task sequence(s) and look for “Windows Update (Pre-Application Installation)” and “Windows Update (Post-Application Installation)” and choose to enable them both or just the latter.
In your customsettings.ini somewhere beneath the [Default] section add the row:
WSUSServer=http://WSUSServerName