The desktops are kept up-to-date with patches
by cfengine checking for updates every 15 minutes.
They have plans for desktops to boot
into Windows once a week so the Windows patching can
happen.
On the other hand, there are enough Windows-based classes
for it to happen naturally at the moment anyway (the Windows system
has a similar patching-update system).