But my favorite saying of yours, about AD and eDIR and how they rate...
Well, that *N* company has a REALLY SPIFFY product. ZEN or at least it was that when last I touched it.
It can do binary patches, replacement patches, verifies of patches... and it can also manage you installations as well. Each image can be built upon another image upon another image... etc
You also, create DIFFs of said images and apply the diff only as well. They also have a very nice "re-installation" setup that CAN BE completely Directory driven. Can also, remove patchsets as well.
This was all before the Security Problems in Windows was REALLY evident.