Microsoft advises you to permit Windows to automatically download and install recommended updates, but you do have other choices.

In some cases, you may not want a to occur automatically. Occasionally, for example, changes to IE or TCP have broken third-party firewall connections to the Internet. If you prefer to wait a day or so to make sure that no such surprises lurk in the latest patch cycle, select the second Automatic Update option to download updates but install them later. If you adopt this approach, a yellow shield icon bearing an exclamation point will appear in the task tray whenever your system downloads a new update; the shield icon will remain there until you take appropriate action.

The updates will sit on your computer until you click the yellow shield icon or until the next time your reboot your computer. At that point you should see a dialog box that asks you to choose between an Express install and a Custom install. Express installs the updates exactly as Microsoft provides them. Custom enables you to pick and choose (suitable when avoiding a service pack, for example).

A third choice is to have Windows notify you whenever new patches are available, but not have the operating system download or install those updates. In this case, you'll see a listing for each available patch, togther with its title and its Knowledge Base article number (where you can find additional information). You can uncheck any update you don't want to download and install; Microsoft will suggest all such bypassed patches again the next time it has a new update ready or the next time you check for updates yourself (see below).