reinvent the wheel for moving from WSUS to DC?

Hi,

I am hoping that someone can save me the hours involved in trying to figure out the best/easiest way to push patches. Specifically, the issue is how do I use test computer groups for patches and then release/approve them to production when ready. Currently, WSUS provides a very simple way in the creation of your own computer groups. I have groups like XP - test, Windows 7 test, etc.

Also, we do not want patches that we've approved for production clients getting pushed to any servers as we manage the timing of patching them separately and on a less frequent basis (at least for non internet facing servers).

From what I can see, one way to do this would be to move the test machines into their own OU in A/D.

I'd like to humbly suggest that it would be very useful to your customer base to provide a short best practices guide for this and/or just provide some examples of various ways to do this. I imagine this would help all of us sys admins save hundreds of combined hours (though, admittedly I have no idea of how large DC's user base is) in trying to figure this out on their own.

Lastly, we do not have a huge budget and have needed for years some solution to update 3rd party apps - DC looks to be an affordable solution for a dire need.

Thanks in advance,

David