1. Use Microsoft SMS to deliver the patch.
2. Use rcmd to logon to each machine and install the patch from the command line. This can be automated.
3. Method 2 is not quite secure. A secure method would be to install ssh server on each machine and use ssh instead of rcmd. Again, this can be automated too.
You can combine method 2 and 3: use rcmd to install ssh server remotely and use ssh for security update and any future update. The only catch for method 2 and 3 is that Windows 9x/ME might not support rcmd or ssh.
A version of OpenSSH v3.0.2 on Windows can be found in the attached link.