Software Deployment

create patch labels for the patches in question and link them to systems which don't want the patches in individual schedules

Thanks for the reply - but I have only found one way to assign patches with label to a machine to install. I am looking for a way where a patch is NOT installed on the machine. 

Maybe I'll make this a little more concrete:

VM1, VM2 and VM3 each need a different number of patches (6-20 pcs).

But all of them need an update for application XYZ.

I now want this update of application XYZ NOT to run on VM2 for the next two months.

For the other two VM1 and VM3 I want to install all necessary patches  (6-20 pcs) also for application XYZ.

So when we build patching routines for customers, yes the majority of devices that are targets are in smart labels, however we create an exception MANUAL label and when we build the smart labels we always include "where label name does not include M_Exception label", this means that we can exempt any machine from any patch schedule by simply adding that machine to the Exception label. Does that help?

Actually, that doesn't really help me. I already know how to remove the machine from patching.

I wanted to know if there is a way to deny a patch for only one machine. (Yes / No)

Apparently there is not the possibility and I have to build a workaround (as already suggested).

So the answer I would have expected would have been "No, unfortunately that's not possible" ;-)