topic ISE Windows Update Check? in Network Access Control

ISE Windows Update Check?

AJ Cruz — Mon, 11 Mar 2019 03:04:09 GMT

I see in ISE Windows Update remediations, but I don't see how to check for missing windows updates?

Anyone find any documentation on this or know how to do it?

Thanks

ISE Windows Update Check?

nspasov — Sat, 09 Feb 2013 04:35:33 GMT

You will need to configure some posture checks. A very good source of documentation is Cisco's TrustSec guide:

http://www.cisco.com/en/US/solutions/ns340/ns414/ns742/ns744/landing_DesignZone_TrustSec.html

Thank you for rating!

ISE Windows Update Check?

AJ Cruz — Sat, 09 Feb 2013 04:41:39 GMT

I didn't see how to do the posture checks, I discovered the issue was I was always looking in the "Windows all" group. When I select a specific platform like "Windows 7 (all)" then I see the hotfix checks.

ISE Windows Update Check?

nspasov — Mon, 11 Feb 2013 04:14:00 GMT

Very good! So your issue is solved then? If so we should close the thread

ISE Windows Update Check?

danielnunes — Fri, 17 May 2013 16:15:18 GMT

Hi Friend,

please, did you find how to check the last updates on Windows?

I can not find out how to do this!!

Could you help me about it?

thanks a lot

Re: ISE Windows Update Check?

askhuran — Sat, 18 May 2013 16:29:03 GMT

You cannot adopt a manual method to check for missing Windows Update. It is the Windows Update Services (WUAUSERV) that checks for the Windows Update State of a machine using query response mechanism and by checking various files as well as registry settings and whether last update was successfully completed.

Windows update information and settings are at the following path in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update

Key Value Pair: NextDetectionTime

You may require to create Registry Condition & Compound Condition. Besides this you can also probe some other values in the above registry key path

So for that matter, You can configure posture validation based on the registry

Optionally, you can configure Windows Server Update Services (WSUS) remediation instead for your posture validation policy. More detailed help is available at the following location:

http://www.cisco.com/en/US/docs/security/ise/1.1.1/user_guide/ise_pos_pol.html#wp1979471

Hi did you ever find a

michael Helmbo — Fri, 15 Jul 2016 07:59:20 GMT

Hi did you ever find a solution to this problem?

We don't really care about specific updates. We just want to check for windows having the latest updates available - so its also is auto updated instead of us having to manually update with specific updates.

Thanks

Re: ISE Windows Update Check?

karenmar — Wed, 08 Mar 2023 05:08:52 GMT

Hi AJ, can you please explain the method you used for this ?

Re: ISE Windows Update Check?

hslai — Sun, 12 Mar 2023 17:04:32 GMT

@karenmar This is an old thread. In the future, please start a new one.

From what AJ wrote, it appears using the hot fixes provided by Cisco.

Re: ISE Windows Update Check?

Fernando Segura — Wed, 07 Aug 2024 11:34:26 GMT

Hi, sorry to reply to this old thread, I use this predefined check

HTH