Best way to deploy security patches via a GPO would be to create an .MSI
package. Somewhat time consuming, but certainly possible. You should
seriously consider deploying SUS on your network. It's a breeze, really. All
you need is an existing 2K server, IIS, and the free SUS software from
Msoft. You can then configure your group policy to have your clients poll
the SUS server at specific times to obtain all the latest security
patches(computer config/admin templates/windows components/windows update)
that you approve. It took us about 3-4 hours to get SUS online and
activated.
Regards,
BT