Exclude or block updates

Sometimes a specific operating-system update should not install — a faulty driver, a disruptive KB, or a whole class of updates you never want on your fleet. octoja gives you three ways to stop an update, and which one you pick depends on how far the exception should reach.

Before you start

All three methods use the same permission.

• You need the Patch Policy Management permission to add policy exclusions, to turn on the known-problems switch, and to block updates — the same permission that lets you create and edit patch policies. Permissions are granted per group under Administration → Groups (see How Users, Groups & Permissions Work).

Exclude an update in a patch policy

A policy exclusion stops matching updates from reaching the devices that policy covers — even when the update was already approved in a cycle.

1. Go to Patch Management → Policies and open a policy, or create one (see Set up patch policies and cycles).
2. Scroll to the Exclusions section and click Add Exclusion.
3. Under What does the rule match?, choose Update ID, KB article number, or Category.
4. Enter the matching Value — for example the KB number KB5041023, or a category such as Drivers.
5. Add more rules if you need them, then click Save Policy.

Windows update IDs can include the revision: wua:<UpdateID>:<Revision>. An exclusion using this full identifier applies only to that revision. A bare Windows Update ID without the prefix and revision matches all revisions of that update; existing exclusions using those IDs remain effective. Use the KB article number to exclude all updates associated with a KB.

A policy's Customer scope decides whose devices it covers. Leave it empty to apply the policy — and its exclusions — to every customer's devices. An exclusion covers all rings of the policy, so it reaches every device that policy manages — but it does not touch devices handled by another policy. For an update that must never install on any device anywhere, use a global block instead.

Block an update globally

A global block stops a single Windows update — identified by its KB number — across your entire instance. A blocked update is never delivered to any device, is left out of newly generated patch cycles, and auto-promotion will not carry it to further rings. A block runs until you lift it — or until an expiry date you set when you block it. Global blocks cover Windows updates only; to stop a macOS update, exclude it in a patch policy instead.

1. Go to Patch Management → Update Catalog and open the update you want to stop. An update appears in the catalog once it is pending on a device or has been part of a cycle — you can only block an update that is already in the catalog.
2. On the update's page, click Block update.
3. Optionally type a Reason so your team knows why.
4. Leave Blocked until (optional) empty to hold the update until someone releases it, or pick a date — the block then lifts at the end of that day. Today is the earliest date you can pick.
5. Confirm with Block update.

The update now carries a Blocked badge — on its own page and in the Update Catalog list, so blocked updates are easy to spot; where you set an expiry date, the badge in the list reads Blocked until that date. The update's own page adds the reason and either the expiry date or Blocked until manually released. To allow it again — before the expiry, or at any time if you set none — open the update and click Unblock update.

Note: A global block is enforced when updates are delivered to devices, so a blocked update is never installed — even if it is added to a manually created emergency patch cycle.

Hold back updates with a known problem

A patch policy's Exclusions section also carries a switch called Exclude updates with known problems. Turn it on and click Save Policy, and that policy withholds any update that currently has an active problem reported against it — an unresolved Microsoft known issue, a red or yellow community flag, or reports from other octoja users. You never name the update yourself: octoja matches the advisory data it syncs every hour against the KB numbers of the updates the policy would deliver.

Unlike an exclusion rule, this one clears itself. Once none of those signals is active any more, the update is delivered again automatically — you do not have to go back and undo anything. A global block can end on its own too, but only on the date you set; this switch follows the problem rather than the calendar. The advisories are keyed by KB number, so in practice the switch only affects Windows updates, and it is set per policy, so turn it on in every policy that should wait for a clean bill of health.

Which one should you use?

Reach for a policy exclusion when the exception is targeted — a specific customer or a single patch policy. Reach for a global block when the answer covers the whole instance: this Windows update must not install anywhere, on any device. A global block is the direct way to say "do not ship this KB" without editing every policy one by one — and if you only want to sit out the next few weeks, give it an expiry date instead of lifting it by hand later. Reach for Exclude updates with known problems when you do not want to track individual KBs at all — it is a standing instruction to skip whatever is currently reported as broken and to pick it up again once it is fixed.

An exclusion is also different from rejecting or deferring an update during cycle review: a reject or defer applies only to that one cycle, and the update can return in the next one. A policy exclusion is permanent for its policy — it keeps the update off that policy's devices in every cycle, until you remove the rule.

See also: How patch management works for the full picture, Set up patch policies and cycles for creating policies, rings, and cycles, and How Users, Groups & Permissions Work for granting the Patch Policy Management permission.

FAQ

Why are excluded drivers still visible on the Updates tab?

Exclusions control installation, not the inventory of available updates. An excluded driver can remain visible without being installed by octoja. Use the table search to narrow the view by title, category or KB number; searching does not change approvals or exclusions.