Ignoring Software Did Not Prevent from Patching

Issue

You marked a software title as Ignored on a device (from the Software page or Device Details) to stop it from being patched, but a patch policy still updated it on the next run.

Environment

• Automox (current agent release)
• Windows, macOS, and Linux devices
• Console areas: Software page, device Device Details page, Patch policies

Overview

Ignoring a title does not block a patch instantly. It changes what the device reports as needing a patch, and that new status only reaches your policies after the device runs a scan. If a policy executes before the device has scanned, the device still reports the title as patchable and the policy installs it — the ignore was set, but it hadn't been registered yet.

Resolution

1. Confirm the ignore was applied at the right scope:
   • Ignoring from a device's Device Details page affects only that device. To exclude a title everywhere, ignore it from the Software page, which acts across the matching devices. See Configuring Software on a Device.
2. Run a device scan before the next policy execution:
   • This is the most common cause. The ignored status must be registered by a scan before a policy runs, or the policy will still patch the title. Scan the device (or wait for its next scheduled scan) and confirm the title now shows as Ignored.
3. If ignores routinely register too late, tighten the scan interval so status changes are picked up before policies run:
   • See Scan Interval Best Practices.
4. For a durable exclusion rather than a one-off ignore, choose the method that fits:
   • Ignore — immediate, best for one-off or temporary blocks on specific devices.
   • A Patch Only policy scoped so it simply does not target the title (for example, a Patch All Except configuration).
   • The Block List for Windows patches.
   • All three are covered in Prevent Specific Software From Updating in Automox.
5. Re-verify after the next scan and policy run to confirm the title is no longer being patched.

Notes

• Ignore takes effect immediately in the console, but is only reflected in policy targeting after the device's next scan — the gap between the two is where unexpected patching happens.
• Removing the ignore reverses this the same way: the title becomes patchable again only after the next scan.
• For background on how scans and check-ins differ, see What is a Check-In vs. Device Scan?.