Related to this question, it was proposed in the comments that it frustrates the user even more when when they go to shutdown their workstation and it takes forever to install updates. However, it's a guaranteed time when they won't be using their computer, hence the best time to do it. The alternative is to do it in the background while their working, however the used CPU percentage will be perceived as 'System Slowness' and generate calls to the helpdesk.

Suuuuure, one can 'wait' for some undetermined amount of time for a user to leave their machine at the login prompt for a couple hours (I don't know yet how successful I'll be at trying to make this a policy), signifying that they've left for the day (maybe), but patching machines by happenstance isn't really the greatest way to protect machines from threats.

So I ask: What's the best time to deploy these updates? Even if I can't deploy them during this opportune time at least the theory behind it will point me in the right direction. Off-hours is an idea but I can't force a reboot which puts the computer in an unpredictable state, potentially generating a call to the helpdesk.