Exclude or block updates

Sometimes a specific operating-system update should not install — a faulty driver, a disruptive KB, or a whole class of updates you never want on your fleet. octoja gives you two ways to stop an update, and which one you pick depends on how far the exception should reach.

Before you start

Both methods use the same permission.

• You need the Patch Policy Management permission to add policy exclusions and to block updates — the same permission that lets you create and edit patch policies. Permissions are granted per group under Administration → Groups (see Assign Permissions).

Exclude an update in a patch policy

A policy exclusion stops matching updates from reaching the devices that policy covers — even when the update was already approved in a cycle.

1. Go to Patch Management → Policies and open a policy, or create one (see Set up patch policies and cycles).
2. Scroll to the Exclusions section and click Add Exclusion.
3. Under What does the rule match?, choose Update ID, KB article number, or Category.
4. Enter the matching Value — for example the KB number KB5041023, or a category such as Drivers.
5. Add more rules if you need them, then click Save Policy.

A policy's Customer scope decides whose devices it covers. Leave it empty to apply the policy — and its exclusions — to every customer's devices. An exclusion covers all rings of the policy, so it reaches every device that policy manages — but it does not touch devices handled by another policy. For an update that must never install on any device anywhere, use a global block instead.

Block an update globally

A global block stops a single Windows update — identified by its KB number — across your entire instance. A blocked update is never delivered to any device, is left out of newly generated patch cycles, and auto-promotion will not carry it to further rings. It stays blocked until you remove the block. Global blocks cover Windows updates only; to stop a macOS update, exclude it in a patch policy instead.

1. Go to Patch Management → Update Catalog and open the update you want to stop. An update appears in the catalog once it is pending on a device or has been part of a cycle — you can only block an update that is already in the catalog.
2. On the update's page, click Block update.
3. Optionally type a Reason so your team knows why, then confirm with Block update.

The update now carries a Blocked badge — on its own page and in the Update Catalog list, so blocked updates are easy to spot. To allow it again later, open the update and click Unblock update.

Note: A global block is enforced when updates are delivered to devices, so a blocked update is never installed — even if it is added to a manually created emergency patch cycle.

Which one should you use?

Reach for a policy exclusion when the exception is targeted — a specific customer or a single patch policy. Reach for a global block when the answer is absolute: this Windows update must not install anywhere, on any device. A global block is the direct way to say "never ship this KB" without editing every policy one by one.

An exclusion is also different from rejecting or deferring an update during cycle review: a reject or defer applies only to that one cycle, and the update can return in the next one. A policy exclusion is permanent for its policy — it keeps the update out of every cycle that policy generates.

See also: Patch Management for the full picture, Set up patch policies and cycles for creating policies, rings, and cycles, and Assign Permissions for granting the Patch Policy Management permission.