# N-1 Patches

Patch management requirements vary across environments. The operating systems, software versions, and business-critical applications you run all influence the type of patching strategy you need. Some applications require frequent updates, while others only support specific software versions. To support these scenarios, we’ve introduced N-1 patching, which lets you deploy older, superseded patches when needed.

This document explains what the feature does, how to enable it, and what to expect once it’s configured.

## What is N-1 patching?

In IT, N-1 patching refers to installing a version of software that is one release behind the latest update. Depending on your requirements, this may extend to N-2, N-3, and so on.

## What are superseded patches?

When a vendor releases an update that includes or replaces an earlier patch, the new patch is called the superseding patch, and the older one becomes a superseded patch.

## How to identify superseded patches

In Endpoint Central’s patch management products, go to **Threats & Patches → Patches → Supported patches**. Create a filter where **Status = Superseded** to view all supported superseded patches.

## When is N-1 patching required?

### Server patching

Admins who patch servers sequentially may not complete deployment before a new update is released. As a result, servers may run different patch versions. N-1 patching allows you to install superseded patches to maintain consistency.

### Organizational policies

Some organizations intentionally deploy older patches, waiting a few weeks to ensure new releases are stable. The N-1 patching option supports this workflow.

### Compatibility requirements

Certain applications may only support older software versions. If a newer patch introduces issues, you can deploy a stable, superseded version instead.

## Endpoint Central N-1 patch settings

The reasons stated above are only a few of the actual requirements that enterprises have. It is to tackle such situations that Endpoint Central has introduced its latest settings — **N-1 patch settings**. N-1 patching is available for Windows and Linux platforms (Red Hat and Debian).

![N-1 patch settings page](https://www.manageengine.com/products/desktop-central/images/n-1-patches.png)

N-1 patching does not use a separate patch-scan schedule. After changing the N-1 setting, allow the standard database synchronization and endpoint patch-scan cycle to complete before checking the patch views. For scan behavior and manual scan options, see [Patch Scan](https://www.manageengine.com/products/desktop-central/help/patch-management/patch-scan.html).

### Viewing and managing schedules

## Enable N-1 patching (Windows)

Enable N-1 patching only when your organization intentionally deploys superseded patches or delays deployment by one or more release cycles. Newly released patches continue to appear while this option is enabled. If your organization does not follow this strategy, you can disable the option without affecting normal latest-patch deployment.

Enabling N-1 patching adds retained superseded patches to applicable patch views and can reduce the current compliance percentage. If you enable it temporarily to generate a previous-period compliance report, apply the required release-date filter, export the report, and then disable N-1 patching.

If you cannot select a patch checkbox to approve, download, or install it, the patch has been superseded by a newer version. It is generally not recommended to deploy superseded patches. If you still need to deploy that KB, enable N-1 patching for Windows.

- Navigate to **Threats & Patches → Settings → N-1 patch settings**.
- Select **Enable N-1 patching for Windows** to retain superseded patches for 3 months.
- After enabling the feature, superseded patches appear across patch views once the Central Patch Repository synchronizes with the Central Server. You can deploy superseded patches from the **Missing patches** view.

## Best practices for N-1 patching (Windows)

- Enable **Download the patches missing in the network** under **Patches → Settings → Cleanup settings → Patch download settings**.
- Disable **Remove superseded patches** under **Patches → Settings → Cleanup settings → Patch cleanup**.
- Adjust the cleanup schedule under **Patches → Settings → Cleanup settings → Patch cleanup → Remove the patches that are older than** to suit your N-1 patching needs.

## Enable N-1 patching (Linux)

For detailed steps and management instructions, see:

- [N-1 patching on Debian](https://www.manageengine.com/products/desktop-central/help/patch-management/n-1-patching-in-debian-linux.html)
- [N-1 patching on Red Hat](https://www.manageengine.com/products/desktop-central/help/patch-management/n-1-patching-in-redhat-linux.html)

## FAQ

### What happens when this option is enabled?

For Windows, superseded OS and third-party patches from the past 3 months appear under **Missing patches**, **Installed patches**, **Applicable patches**, and **Supported patches**.

For Linux, superseded patches from the past 6 months are shown.

### What happens if I deploy all patches from previous months at once?

The agent installs the oldest patches first.

### How are third-party patches with dynamic URLs handled?

Some vendors host the latest patch version at the same download URL. If you enable N-1 patching, download older patches before they are replaced by the latest version.

### How does this option affect the Decline patches feature?

When enabled, both superseded and latest patches appear under **Missing patches**. You can decline superseded patches individually based on your requirements.

When N-1 patching is disabled, superseded patches are not retained for deployment. If a declined patch is superseded, the superseded patch is removed from the **Decline Patch** view and only the latest applicable update is retained.

Enabling N-1 patching expands the patches evaluated in the Missing, Installed, Applicable, and Supported views. Superseded patches can therefore be evaluated as missing and reduce the displayed compliance percentage. Consider this effect before changing the setting; do not enable N-1 solely to generate historical compliance reports.

## Related

- [Patch Database Settings](https://www.manageengine.com/products/desktop-central/help/patch-management/patch-db-sync.html)