64Bit fully patched as of today.
The normal exceptions apply to Windows Malicious Removal tool, and the defender updates. They update too often for me to contemplate adding them.
When I get a second, I might add instructions on how to make it auto activate if it's an OEM system (Dell, HP, Acer and so on....). It's pretty easy and means you're never messing about activating on a system that has the activation tied to the BIOS.