The other option is to have users never update their machines. That's very, very bad. The issue here is your systems administrators not properly testing updates before deploying to production.