You'll need to set up an "unfreeze" time for the WS using DeepFreeze. This is usually a 2-6 hour period when the workstations can be updated and retain the changes, then set McAfee update tasks to take place during that period. Similar for WSUS, but DF has particular requirements for WSUS. These are explained in the DF documentation.
This is due to sequence number checking, as described in KB60776 .
If necessary you can disable the check, but as mentioned in the article this is not something we recommend. DocB's solution is a better approach, assuming it's practical in your environment.