In a Microsoft-predominant network, the new certs can be pushed out via GPO, and probably can be updated with SMS.
For non-Microsoft, or non-AD clients, the certificate can be gained by the users easily by pointing at the http://servername/certsrv URL and performing a few mouse-clicks.
For *nix environments, the cert updates can be installed at the client through the login scripts that also set up their environments.
It's a doable thing, most of the time. There will always be situations that require a "desktop person" in intervene.
FWIW
Scott
