There are dozens of servers and hundreds of workstations, and each of those is in the hands of a person who just wants to get work done. This area covers keeping endpoints in a predictable state: splitting responsibility between Group Policy and management tools, updates, image standardisation, and working outside the corporate network.
Two ways for updates to hurt: never install them, or install them on every machine on the same day. Deployment rings spread the risk across stages, and each stage is a gate for the next.
Group Policy and an endpoint management tool can set the same things. The trouble starts when they do it at the same time. A split of responsibility that can actually be maintained.
Every workstation prepared by hand is different, and the differences show up at the first ticket. How to split a workstation into layers so that any machine can be rebuilt in an hour with no human involved.