Obviously, take a look at just before and just after patching. You ought to be from the behavior of checking the login/logout instances of consumers. Frequently a location Examine will do. Personally, I just look for just about anything out with the normal. For instance, a VPN user logging in at 2 PM from unrecognized IP handle must be a pink flag.