Will the machines not automatically receive the updates once they came online?   Our Symantec AV just does the normal dat updates (just like a physical machine) and then whenever we update the parent image (about once a month)  we will update the AV inside the image.

The only changes we make for VDI is to stagger dat updates and disable the scans post dat updates.

They will probably get updates but every time is is going to be a full update since the last recomposition.  Isn't it going to generate a lot of extra traffic? Microsoft and our WSUS server are pushing new updates every day.  Are you saying that your machines get updated Symantec virus definition once a month?