For those with client firewalls -- how do you update the client?

[Maser]

So, I noticed there was a 6.3.028 client out (I had last distributed 027 so I don't know how I missed 028, but...)

 

If you push client upgrades from the console -- and the firewall is on the Mac client -- a box pops up (expected) that requires you to "allow" the client through the firewall.

 

How do other admins manage that? Just "push" then tell the client user to click the box? ARD into the box and hit the "allow" button after pushing the client update out?

 

Or some other way?