How can I deny a patch for a single machine?
You can use the Ignore function to deny a single patch for a single (or multiple) workstations. To do this, navigate to Patch Management > Patch Update. Filter to the machine that you want to ignore a patch on (this just helps to limit the time it takes for the pages to render). Uncheck the two boxes at the top of the page - one at a time, allowing the page to re-render between each uncheck, and search the page (use the browser's "Find" function or CTRL+F) to locate the patch you want to ignore. Click the Machines... button for this patch:
After clicking the Machines... button, you will see the following page, which will automatically filter to the machine(s) you've selected for the single patch. To ignore the patch, select, the appropriate endpoint(s) and click Ignore. This will ignore the patch only for the selected machine(s).
You would need to repeat these steps for each patch. You cannot ignore multiple patches for machines at one time. If you want to ignore the same patch on multiple machines at one time, set your machine/group filter to show the appropriate machines.