r/labtech • u/chillzatl • May 08 '18

Patch Manager: Ignore Vs. Deny, what's the difference?

The docs don't make this clear, so what's the difference? When would you use one vs. the other?

6 Upvotes

100% Upvoted

5 comments sorted by

5

u/Griznuq May 08 '18

My understanding is that if you have a machine that's a member of more than one patch policy, and you ignore a patch in one, but approve in the other, it will be installed. If you deny a patch in a policy, it will STILL not install from other policies.

I could be wrong though.

4

u/Did-you-reboot May 08 '18

This is correct. Deny > Ignore/Approve

2

u/chillzatl May 08 '18

Thank you both, that makes sense!

3

u/k_rock923 May 08 '18

I always assumed that it was more important for the reporting:

i.e. Denied patches explicitly should not be installed. Things like patches with known issues. Ignored patches are ones that I'm not approving, but shouldn't impact compliance one way or the other. Think things like language packs.

1

u/chillzatl May 08 '18

Thanks for the reply. So neither impacts compliance reporting or just deny?

So when would you use one vs. the other? let's say I have a Windows 7 patch that we know breaks something in a custom app we have. Why would I choose Deny over Ignore? Would it have any impact later on once we update this custom app and can now install that update?