One of NetIQ?s priorities when writing the installation program is to NOT require a reboot of the agent machines and typically reboots are not needed. If Security Manager detects locked files during the install, then a restart of the agent box may be required. Part of the upgrade process is to stop the security manager service on the agent machine so that locked files will not be an issue. There are cases where a file/files are locked by other applications and the file will only be released and updated upon restart of the system. If a reboot is needed, there will be a popup box after the upgrade requesting that the agent box be restarted.
The agents should be upgraded sooner rather than later but initially you could do just a few at a time in case there is some concerns about machines needing reboots in your production environment. There is no necessity to upgrade all of the agents at the same time. If the agents are all managed, they can sit in pending until you approve the upgrade. If your company has a package that pushes out unmanaged agents, those can also be done in groups of 10 or 20.