Patching procedure

Hi - just want to ask if it recommend to put the RDS/TS server in install mode or execute mode when applying the (patch tuesday) security updates?

or if I want to add new roles or features to the RDS server i.e windows backup/ DFS services/IIS/WINS -- where only the administrator (not user) to utilize it.?

Regards

Y