1. A method to update a virtual machine template ( 105 ), comprising: updating a management policy ( 110 ); starting a virtual machine ( 116 ) based on the virtual machine template ( 105 ) in a network cordoned sandbox ( 170 ); triggering the virtual machine ( 116 ) to update per the updated management policy ( 110 ); and saving the virtual machine ( 116 ) as an updated virtual machine template ( 106 ).