Does the autogenerated worklet for Patch Only use the MSIRESTARTMANAGERCONTROL=”Disable” flag for attempting to patch running software or can we have an option to enable that?

Given modern compliance requires patching Critical in 2 days rolling the dice on a first checkin Patch policy to try to beat autostart software is not viable.  Using Worklets is also not viable as they would require manual updating when a new patch became available.

What are people doing, or what is considered best practise for things like Teams Machine-Wide, WebEx and Zoom.  We use WebEx for our phones and Zoom and Teams and whatever other client meeting software is required.