how often should I install updates on Windows 2008 R2 server?

I'm wondering how often you would recommend installing updates on Windows 2008 R2 servers? We got two productions servers, one databaseserver running MS SQL and one webserver running IIS 7.0. Would you recommend restarting the servers after installing an update?

Since these are productionservers I want to do this as little as possible but still often enough to avoid security risks.

I am not a system administrator myself, we are "between sa's" so your help is greatly appreciated!

If you want to avoid security problems, then you should install them shortly after patches are released. Microsoft releases scheduled patches on the second Tuesday of every month. We plan downtime for either the second Wednesday evening or Thursday evening to facilitate the installation of these patches, you would do well to implement a similar schedule if you are concerned about the security of your servers.

We review, approve and deploy Windows Updates on a monthly basis for our servers. Some updates require a restart and I would recommend you do when needed. Other updates can be applied without interruption in service.

At least check the Microsoft Security Bulletin Advance Notification prior to each Patch Tuesday.

For SQL Server specific update information, the SQL Server Version database can be quite useful.