Best practice for reinstalling agent including AV

Hello.

We are in a position where we in near future would like to deploy the latest agent to all our workstations in the environment (+10k devices world wide). Most of the devices are currently on a 9.5 SP1 with LDAV+EPS agent and the latest agent will be a 9.5 SP2 with LDAV+EPS and 0417 BASE + AEM patches.

The component I'm worried about when doing this is LDAV. If we hadn't been using LDAV, then reinstalling using the Advance Agent would be quick and easy and it would work almost always, but it's my experience that reinstalling an agent with LDAV can be a little tricky and just reinstalling on top of the existing agent will probably result in various issues with LDAV afterwards (sort of described in the "Uninstall" section here - How to troubleshoot LANDesk Antivirus 9.5).

As I see it, there's 3 ways this can be done:

1. Use the Advance Agent to reinstall. Expect issues with LDAV and repair via "vulscan /removeav" and "vulscan /installav" on devices that show bad or incorrect inventory data
2. Patch the existing agent with Patch Manager using the client side patches for the "LD-95-SP2", "LD95-CP_BASE-2014-0417" and "LD95-CP_AEM-2014-0417" definitions
3. Use self-made agent reinstalling script/procedure that via Patch Manager downloads the full agent installer and script, completely removes the existing agent incl. AV, reboots devices and automatically installs the new downloaded agent

Suggestion 1 requires minimal preparation and is easy to initiate. Downside is that many issues are expected and can take a long time to fix. Can potentially require a lot of manpower.

Suggestion 2 is not something I've done in large scale before. Only tried to install a component patch on a few devices - never tried something large as a service pack for the agent. Looking at the content of the <patch>-client.zip files, I'm not sure if this will actually fully update the agent at all as a file like LDAV.exe is not in the client BASE zip file and files like LDSecSvc64.exe and viguard.exe are not in the client AEM zip file. Will this still require us to reinstall AV and EPS?

Suggestion 3 requires by far the most preparation, but is also the most automated procedure and the end result will most likely be better and require less cleaning up.

How do you guys handle a situation like this?

Thanks in advance.