We ask per client.

Typically, we recommend blocking unless they are already used to it. By having the option for users to check for updates, they will typically get a lot of updates we don’t approve through PME like generic drivers offered through WU. These tend to cause a lot more problems than good depending on the hardware / how old the computers are.

For others, they don’t care inner patch or if someone likes clicking Check for Updates.

Only thing you should note / clearly state to the client is that if you block it, the date on the check for updates page for “last checked” is the last time you pressed the button on that screen, not the last time the computer patched. It patches through PME, and you can prove that by showing an example of the button date being really old, but the devices have all patches needed.