Perhaps I'm doing something wrong.

In ZPM 6.4 (the NON-ZCM version), I can go into Vulnerabilities, Not-Patched/Critical not superceded.

I will see some things like maybe Adobe Flash player. It will list 970 of our 4,500 machines as not being patched (the other machines do NOT even have Flash player on them)

I can then deploy the patch and it will only install on the machines that:
a) have Flash
b) have the version that needs patching.

Now we come to ZPM in ZCM
If I look at vulnerabilities, Not patched/Critical.

It will show Adobe Flash

The issue:

in ZPM in ZCM, it will show every single device as needing this patch even if Flash isn't even installed.

So it'll put flash onto devices that don't even need it.

And it does this for EVERYTHING. Citrix Program Neighborhood (we don't use it, but ZPM in ZCM will happily put it on). Adobe Reader (we don't use it, our pc's all have Adobe Acrobat Standard), but it puts that on.

Is this:

a) working as designed?
b) Can it be configured somehow to work like the standalone NON-ZCM ZPM product does where it only puts things on devices that need it?