Since our machines aren't always on the network at the same time, and we're not on 11.3, we usually deploy patches thusly:
Go into the ZCC -> Patch Management, find all critical MS patches (unpatched) and deploy them.

So let's say it thinks there's 2,000 patches.

Some machines may need 200 and some may need all 2,000

I need to find out which of the 2,000 patches went onto a specific machine.
I have ZR5 installed if that helps.

But if there's a section in the ZCC to see which ones that would be great.