It depends, but usually Windows downloads all available updates that do not require user interaction automatically, and installs them when the computer is shut down and restarted. There are some updates like OS upgrades that get only installed when a logged on (admin) user has opted in.
Citing from "Windows Server 2012 R2 Pocket Consultant Volume 2: Storage, Security, & Networking" p. 199:
Generally, most automatic updates are installed only when a computer is shut down and restarted. Some automatic updates can be installed immediately without interrupting system services or requiring system restart. To ensure that some updates can be installed immediately, follow these steps:
1. In the GPMC, press and hold or right-click the GPO with which you want to
work, and then tap or click Edit.
2. In the policy editor, access Computer Configuration\Policies\Administrative
Templates\Windows Components\Windows Update.
3. Double-tap or double-click Allow Automatic Updates Immediate Installation.
In the Properties dialog box, select Enabled, and then tap or click OK
(In Windows 10, since the November update I believe, there is also an option that allows you to install even those opt-in updates that require (several) reboots unattended. "Under Settings, Updates, on the Advanced options page look for the "Use my sign in info to automatically finish setting up my device after an update". But this does not solve your described problem as pointed out in the comments. Source: https://support.microsoft.com/en-sg/instantanswers/96bdf9fd-06c1-0c4d-ee6a-e77d02fa831e/automatically-finish-setting-up-pc-after-update
See also: http://winsupersite.com/windows-10/quick-tip-how-complete-upgrades-without-logging-windows-10-anniversary-update)
On Windows 10 Pro and corporate managed system the update settings can be tweaked through Group Policies, e.g.
https://docs.microsoft.com/en-us/windows/deployment/update/waas-restart
You can run gpresult /h C:\gpreport.html as admin to check the applied Windows Updates setting of Windows 10.
So, generally Windows 10 keeps itself up-to-date when you reboot the computer regularly. You can refer to the GPO restart options above. It might be also useful in your situation to configure to show update notifications to regular users via GPO.
By default, only users with local administrator privileges receive notifications about updates. You can enable any user logged on to a
computer to receive update notifications by following these steps:
1. In the GPMC, press and hold or right-click the GPO with which you want to work, and then tap or click Edit.
2. In the policy editor, access Computer Configuration\Policies\Administrative Templates\Windows
Components\Windows Update.
3. Double-tap or double-click Allow Non-Administrators To Receive Update Notifications. In the Properties dialog box, select Enabled,
and then click OK.
You may also find this answer, recommending WuInstall for quiet updates, from nog helpful https://superuser.com/a/381869/748438
