[ActiveDir] Patching Strategy on DC's

[Murray Wall]

I have a question about a patching strategy for Domain controllers.  We
have a single forest single domain, 4 dc's, when patching for security
patches should we do all the DC's at once, or do half of them or should
we introduce a test lab or lastly a latent replicated production site
with a dc in it?  Thoughts and approaches appreciated!
List info   : http://www.activedir.org/List.aspx
List FAQ    : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/