Software-defined networking (SDN) is revolutionizing the networking industry, but current SDN programming platforms do not provide automated mechanisms for updating global configurations on the fly. Implementing updates by hand is challenging for SDN programmers because networks are distributed systems with hundreds or thousands of interacting nodes. Even if initial and final configurations are correct, naively updating individual nodes can lead to incorrect transient behaviors, including loops, black holes, access control violations, and others. This paper presents an approach for automatically synthesizing updates that are guaranteed to preserve specified properties. We formalize network updates as a distributed programming problem and develop a synthesis algorithm that uses counterexample-guided search and incremental model checking to dramatically improve performance. We describe our prototype implementation, and present results from experiments on real-world topologies and properties demonstrating that our tool scales to updates involving thousands of nodes in a few seconds.