Kaseya 4.5 has a change to the way that patch approval works. In earlier versions, if a machine was a member of multiple groups and one of these groups contained allowed a patch, the machine would get the patch. This made the approval process tricky, as you would have to make sure the patch was denied in all the collections that the machine belonged to, to ensure it was not delivered to a particular machine.

With 4.5, given the same situation, if the patch is denied in ANY of the collections to which it belongs, then the machine will not get the patch.

With all this in mind, machines that are not in any collection will not have a policy, so they will always allow patches. If you wish to deny a patch, you must create a collection and set a policy.

A simple but effective solution is to create a collection called "All", add all machines to this collection, and use that collection to control patches across the board. Machines can belong to multiple collections, so if you wish to deny a particular patch, you can simply deny it to the "All" collection, and all machines will not install that patch.

Legacy Forum Name: Change to patch approval in 4.5,
Legacy Posted By Username: jnuttall