Patch management varies from environment to environment. The type of OSes, versions of software, and applications you need in your network for business critical activities will greatly influence the type of patching you require. You might be running applications that require regular updates, applications that are only compatible with certain versions of the software, and various other specific requirements in your environment. To cater to such cases we have introduced extended support for superseded patches. This document has all the information on what this new features entails, how to enable it, and what the expected behaviour is.
If a vendor releases a patch or an update that includes/replaces the earlier patch, then the new patch is called superseding patch and the older patch is called superseded patch. Sometimes Microsoft and other vendors wrap multiple releases into a single package, and that package replaces all similar updates before it. In this case the updates replaced by this single package are called superseded patches.
To check for superseded patches in ManageEngine's patch management products, navigate to Patch Mgmt --> Patches --> Supported Patches view. Here you can create a filter with the status = Superseded to get a list of all the supported patches that have been superseded.
Generally we don't need to install superseded patches. We can clearly save network bandwidth and installation time if we deploy the superseding patch (ie, the single update that packs the previous updates) instead of two or three separate updates. Not to mention, the newer patches might come with fixes for the superseded patches, so to stay up-to-date, it is better to install the latest patches. However some Organizations might wish to deploy the superseded or older patches for various reasons, some of which have been mentioned below.
The reasons stated above are only a few of the actual requirements that enterprises have. It is to tackle such situations that ManageEngine has introduced its latest option - "Enable Superseded patches". This option is available for Windows OS and with this option the superseded patches are available for deployment, 3 months after they have been superseded. They can be found under the 'Missing Patches' tab for 3 months after they have been superseded, if admins want to install them on machines missing them.
Once the option is enabled the superseded Windows OS and non-OS (third-party application) patches of the past 3 months is made available under the various patches views (Missing patches, Installed patches, Applicable patches, and Supported patches).
Question 1: What happens when we select all patches of the past 3 months in one deployment? - In this case, the agent will install the oldest patches first.
Question 2: How are third-party patches with dynamic URL handled? - By dynamic URL, we mean that the newer version of the patches are available on the same URL, replacing the older versions. In such cases, if the Superseded patches option is enabled, the admin must download the older patches before they are replaced with the latest ones.
Question 3: How does this option reflect on the Decline patches feature? - Usually when a patch is declined, the superseded versions are also automatically declined and not shown under the Missing patches view. But if the 'Enable superseded patches' option is selected, even when a particular patch is declined, the superseded version of it is still shown under the Missing patches tab.
