!Symantec Antivirus Corporate 10
Install this software from Doit's tech shelf first whenever installing Windows on a new machine.  
!Liveupdate
When checking staff computers, ensure they have live update set to run weekly.  
Lab machines should have Live update disabled by default for the student (or administrator) logon.  But it can be enabled for helpdesk and instructor logons, in case a script is written to automatically update. 
There is a box you can check in the live update preferences which essentially automatically selects yes to everything a user would typically be prompted to respond to in the Live update process.  Check this if you want to run Liveupdate from a script.  
If Liveupdate fails there is always...
!Intelligent Update
Intelligent update can be run directly off Symantec's website.  It seems like it's always at a different website, so search for it from symantec.com. 
If it doesn't work, it is possible to download updates directly and install them.  But this doesn't usually fix the liveupdate issue, whereas once Intelligent update is run, Liveupdate generally works again.