I work at a university as an administrator over all of the public computer labs. Our labs are composed of hundreds of dual-boot iMacs(Mountain Lion + Windows 7) as well as hundreds Windows 7 PC's. To ensure that users don't muck up the machines, we run Deep Freeze on both operating systems. Currently, the only way we've been issuing patches/updates has been by creating an entire new image for the machines, and pushing them onto the machines. My goal is to change that.
My task has been to research patch management on the Mac side. So far, my plan is to use Munki to issue application updates and use Puppet to manage any configuration changes. I've successfully setup servers for both of these tools and am now looking to get all of our clients using these servers for updates so we can do weekly software/configuration updates.
My question: What is the best way for clients to get updates?
Money is tight, so free/open source solutions are ideal. We'd also like to be able to quickly change the update schedule in case we need to install a piece of software overnight. Here's some of the options I've thought of so far:
Option #1: Schedule two daemons on one of my servers that each will SSH into each of the machines I manage. One will be in charge of settings the thaw schedule for Deep Freeze. The other will be in charge of installing munki/Puppet/Apple updates. Advantages here are that I can instantly change my update/thaw schedule if I need to by scheduling the daemon to run at a different times. Disadvantages here are it puts extra load onto my servers.
Option #2: Schedule a daemon on each of my machines to check for munki/Puppet/Apple updates. This will take the load off my server, but isn't as flexible because I won't be able to instantly change the update/thaw schedule until the next set of updates run (Due to DeepFreeze).
Option #3: Have clients download and run a script of mine every half hour or so. The script will check if it's alright to run updates (For example, is it Friday night and am I thawed?). Advantages: I can change the schedule whenever I'd like and decrease server load. Disadvantage, I'd have to script a scheduling engine of sorts.
Any other thoughts on the best way to update clients?