Best Practices

Hi All,

We have patch schedules set up which currently don't include application installers. However, we are having problems with people still getting Windows notifications because things like Flash Player are only getting minor version updates. I found this KB article http://www.kace.com/support/resources/kb/article/best-practices-for-application-patching which has some good advice, but I have a few questions before I try to put this in practice. 

The method described in the article makes sense, but do I need to do this for every single application that might be installed? What about .NET frameworks and other Windows patches/updates? How would I set up the machine/patch labels to handel this since there really isn't one installer to filter against? Even if I did get something set up to encompass these, how would I be sure that a new patch (which I don't need or want) wouldn't be released that might match what I've set up to allow?

We are a manufacturing facility so we also have the added... umm convenience... of having machines and programs which require legacy versions of Java, .Net, etc to be installed for machine communication and ancient programs to function correctly. Would the older versions be replaced by the newer installs or would the be side-by-side? Is there a good way to handle that issue?

I know there are a lot of questions there, but any help or advice on anything would be greatly appreciated!