Gilozard: 1) What part of 'average users can't use or won't know about separate admin tools and forum scripts' and 'downloading and configuring lots of crap makes life hard to IT staff' is hard for you to understand? At this point I can only assume that you are deliberately ignoring my point.
Having worked in IT, here are the possible scenarios
1) Your users are incompetent bufoons. Your IT guy sets the computers, and he makes sure they are set up correctly. Automatic Updates will be set to on.
2) Your users are competent tech users. They ask the IT guys to set the computers to their liking.
3) Your IT is incompetent. You are screwed.
Gilozard: 2) Fair enough - but most users aren't able to adapt to significant visual changes, since they rely on visual cues to tell them what to do. And sometimes the changes aren't solely visual, they're actual changes to workflows which is a whole other ball of ugly wax. Until you've had to walk a middle-aged manager though accessing the file server for the 5th time, you really don't understand how hard computers are for some people.
I have. A background in education does help, since you shouldn't tell them "Click this icon" but explain what they are looking for, and where it may be found. If you lack the patience, the "Give me 5 minutes and I'll do it myself" is a valid solution as well.
Gilozard: 3) Yeah, and that's helpful. But it's still not the same as the easy, obvious Win7 functionality of Let People Install Their Own Crap.
Group Policy Editor has existed for more than 15 years. Anyone who wishes to call himself an expert on computing should really be aware of it.
Gilozard: Also, group policies need all the computers to be in a group.
? You mean the Workgroup "WORKGROUP"? Because that's the only group my computer is on, no domain, nor anything else.
Gilozard: TL;DR Speaking as an overworked IT admin, WIn10 does not look like a good bet at this point. The Update changes are on a long list of items that mean I'm going to lose time I can't afford just to get people back to productivity, for no real feature gains that anyone here cares about.
Go to MDL, spend a couple of weeks reading, then deploy Win10 in one sweep. If you are the IT admin, you should be the one that says when Win10 is ready to be installed, unless the "IT admin" is just a title, and someone else makes the decisions. In that case, you have my sympathy.
P.S. Disable the admin account and give the people a restricted one. Will save you quite a bit of headaches, especially if you reply to any requests about programs with "That may be a security risk, please file a formal request so I can check it, and if it passes inspection, I may install it".