Our policy is we have an ad group for our IT department. There are also some sub groups. We use the Desktop Support group as our test group. After tested on them then we test to IT as a whole. After testing is complete we roll out to the entire organization.