Patching Methodology and Configuration

Question

SCCM 2012 SP1
We recently implemented monthly patching via SCCM and I’ve been asked to reevaluate the methodology I put into place as well as some configuration items. 
My question revolves around methodology and configuration. 
Sorry for long documentation but need to get point across and find out best methodologies and the way your organization is using SCCM to patch.
CURRENT METHODOLOGY
We roll out patches in a 3 wave approach to an organization that has 4 geographic sites.
IT department and testers during the 3 days following Patch Tuesday – configuration of ADR below.
Sub-Process
Evaluate on Wed of Update patches to include/decline from deployment as not included in software Update classification to prevent unwanted optional updates from being applied
Checklist review after patching by IT Dept. and testers
Deployment to local geographic site which is local to the IT Department on the Tuesday following Patch Tuesday with a 10 day window for install. 
Approximately 150 users.  Idea here was users are local to IT and we can respond faster to problems
Deployment to Entire Company on the 2^nd day of following month (Approximately 400 Users (remote and local)
ADR Settings
Roll-Out 1
Software Update Tab
Date: Last month
Product:  Lync, Office, Silverlight, Windows 7, Windows 8, Adobe patches
Update Classification:  Critical Updates OR Security Updates OR Service Packs
Note: Not including Updates
Evaluation Schedule
Second Wed of every one month @ 7am
Deployment Schedule
Software Available Time:  2 hours
Installation Deadline:  46 hours
User Experience
Software Installation, System Restart Checked
Suppress:  Only Servers checked (for configuration discussion)
Roll-Out 2
Same Software Update settings and User Experience settings
Evaluation Schedule
Third Monday of every 1 month
Deployment Schedule
Specific Time:  26 Hours
Installation Deadline:  249 Hours (6pm on following Friday)
Roll-Out 3
Same Software Update settings and User Experience settings
Evaluation Schedule
Occurs day 1 of every 1 month
Deployment Schedule
Specific Time:  26 Hours
Installation Deadline: 129 Hours (6 pm 5 days later)
MANAGEMENT QUESTIONS METHODOLOGY AND SUGGEST ALTERNATIVE
My management feels the above approach is not best practice for Patch Management. 
They feel that we need a better approach to the testing phase and then an entire company rollout. 
It is felt that the testing group should capture each type of machine type we have as well as User Profile (i.e. Marketing, Engineering, etc…)
My issue is getting users that fit machine type usage and User Profile to participate in the testing procedures. 
I estimate we have 20 different machine types.
Thus under Management approach
Deploy on to test group and allow to test for 2 weeks
Deploy to entire organizaton
An alternative may be as follows:
ADR to the test group that consists of all machine types and identified user profiles
Deploy on day after Patch Tuesday
Run test period for a period of 8 days to following Friday
ADR to remainder of organization based on no issues in testing
Q:  Are you using ADR – Automatic Deployment Rules or are you reviewing the patch list and then selecting them and creating a new Deployment?
Q:  What are your organizations doing with SCCM and do they follow are current methodology, proposed methodology or something different.
CONFIGURATION
Our current configuration, as noted, pushes to the patches to the machine and then the user is notified over time to perform the patching or be patched by the mandatory deadline. 
It has been asked of me to change this concept to immediately install patches on machine and then allow user to reboot when they want, i.e. no mandatory which causes reboot. 
Q:  How would this be configured and are their concerns that a user may wait a couple days after machine has patched to reboot and this causes ancillary issues? 
The only way I know possibly how to do this is
Leave System Restart if Necessary uncheck
Check Suppress system restart on workstations
My concern is if I remember correctly is by setting mandatory deadlines it overrides these behaviors and installs and reboots the system?

Answer 1

Suggestion #1: Forget about them (management) dictating "who to target". If you want to be truly random, create a collection where the collection rule is... where smsguid like '%0' . See how many targets you get in that collection. Since the guid
is random, selecting a random sample of machines will also be random. The only thing to be aware of is that random MEANS random. So if that means you end up with the CEO's laptop in the pilot, that's exactly what that means. It could happen. But that's the
whole point.
Suggestion #2: It has always bugged me that management wants machine patched... but don't force people to reboot.  It can easily happen (quite often) where that means a box is online and not rebooted for months.  For pilot #1, #2, and production--set
the deadline for whatever means "likely to be online... but least likely to impact the end user", and enforce the reboot at deadline.  Set your Client Agent Setting for countdown to a reboot to be reasonable for your environment--if that means
99 minutes, then so be it.  give people 99 minutes and a 15 minute (or 60 minute if you want to be really obnoxious) can't-close-this notification that a reboot is about to happen.  Forget about the 'allow a user to reboot when they want'. 
Instead set it so that people get plenty of time to see that they will be rebooted... and they better save whatever it is they are working on prior to the reboot.
No matter what you set, people will complain about it.  The people that want to work up to the last second prior to the reboot will complain about the notification they can't close, and the people that take a 70 minute lunch/coffee/siesta will complain
that the notification is only 60 minutes long and they didn't see it.  Your job (management's job) will be to find the happy medium, or at least communication "this is what this means... basically... just save your work and reboot now, this is for
your own good."
Edit:  also... remember in CM12 you can set a service window that applies ONLY to patches.  So you could set that (for example) the machines that are always online (VDIs and servers) have their Software Update window on the weekends.  and
laptops don't have a service window for Software updates... because who knows when they might be online; so you don't want to limit them.  etc. etc... whatever makes sense for you computers.
Standardize. Simplify. Automate.