Configuring Patch Management Exclusions

 

By default, applications on devices with Patch Management enabled will be patched during patch deployment. If you need to exclude certain patches from being deployed, you can do so via the Exclusions settings of a selected policy. Once a product (application) is added to the Patch Exclusions list, the patches for that product will stop being deployed. If needed, you can edit or delete these exclusions at any time.

Adding Exclusions

To add a patch exclusion:

1. Open the Policies page
2. Click the desired policy to open its Detail drawer
3. Select the Exclusions tab
4. Expand the Patch Management exclusions section
5. Click + Add new exclusion

6. From the list that opens, choose the vendor(s)/product(s) to exclude from patching (depending on the checkboxes you tick, you can exclude all patches related to the vendor/product or only those of certain severity)
   • If you tick a checkbox next to a vendor name, the exclusion will apply to all products from that vendor. To apply the exclusion to specific products only, expand the vendor, then tick the checkboxes next to those products.
7. Click Add new exclusion

Once added, the exclusions will be displayed on the Patch Exclusions list.

Excluding a vendor or an app will not prevent scanning for the patch, it will only prevent its installation.

Editing and Deleting Exclusions

You can edit/delete any previously configured patch exclusions using the pencil/trash bin icons located in the Actions column of the Patch Exclusions list.

To delete an exclusion, simply click the trash bin icon next to it.

If you just need to modify an exclusion's severity level, click the pencil icon instead, select or deselect severities listed in the drop-down menu, then click the save icon.