Not every enterprise environment can push a brand-new patch the day it lands. Whether you're halfway through a critical server rollout, running change-freeze policies, or maintaining app compatibility on certified builds, Patch Manager Plus keeps superseded updates available and deployable so you never lose control of your build baseline.
Everything you need to control which patch version deploys:
- Retain replaced Windows patches for three months and Linux patches for six months.
- Block newer releases individually while preserving access to superseded versions for specific target groups.
- Track superseded patches across Missing, Installed, Applicable, and Supported console views.
- Deploy multi-release tasks safely with agents that automatically install the oldest patch first.
- Save third-party binary installers before vendors overwrite static download links.
Why day-one patching doesn't work for every fleet
In a uniform lab environment, installing the latest rollup is simple. In complex production networks, vendor update schedules frequently clash with operational reality:
Multi-stage server rollouts
Deploying patches across hundreds of production servers requires phased testing and maintenance windows that outlast a single vendor release cycle. N-1 retention ensures your entire fleet lands on the exact same tested baseline, even if a newer version drops mid-rollout.
Strict change approval boards
When governance policies mandate a two-to-four-week observation period before clearing updates for deployment, automated tools that purge superseded updates force unnecessary exception handling. Patch Manager Plus honors your testing windows.
Compatibility-sensitive applications
Line-of-business applications often require specific OS patch levels to maintain vendor support. N-1 patching lets you update systems to the highest certified build without pushing an unsupported, breaking release.
Vendor URL overwrites
Third-party application vendors frequently reuse download URLs for new releases. Capturing and retaining superseded binaries ensures you can always deploy the exact version required for legacy app compatibility.
How Patch Manager Plus keeps the version you need available
Turn on N-1 patching and a replaced patch stays deployable for three months on Windows and six months on Red Hat and Debian. These updates stay fully visible and actionable across all core console views, including Missing, Installed, Applicable, and Supported patches.
Combine N-1 retention with existing Decline Patches workflows to hold target groups on known-good builds while allowing standard desktop groups to move ahead to the latest release.
Pro-tip for admins
Patch repository cleanup scripts run on automated maintenance schedules. When enabling N-1 retention, verify your central repository cleanup thresholds to ensure downloaded local binaries aren't purged before your retention window closes.
Need visibility into your operational security exposure?
Deploying N-1 patches resolves application stability issues, but running older builds requires continuous risk assessment. ManageEngine Endpoint Central offers built-in vulnerability remediation, automated patch testing, endpoint detection and response (EDR), and ransomware protection—using the exact same lightweight agent.
Manage unlimited endpoints, free for 30 days.
Scan, test, deploy and report patches for Windows, macOS, Linux and 1,100+ third-party applications from one console.