well, first I would use BigFix Manager, It monitors machines on your network , and than deploys the patches that the machine needs, it programmable and it works damn good, better than the normal system patching, or you can use HFNetChk (Hotfix Network Check) but it does not install the patches just tells you what each machine needs and were to fine it.