At Oxford, many different policies:

1. Test out the patch on a master machine and then when happy tell each machine to update.
2. Every night, on each machine:
   • run a cron job that does the patching;
   • reboot may be required, e.g., if patch is to kernel;
   • negotiate with the user as to when convenient.
3. Leave it to each user to update their machine.