topic Microsoft windows profiling in Network Access Control

Microsoft windows profiling

xtreme — Sun, 29 Sep 2019 09:25:27 GMT

What is the best way of profiling machines running different version of Windows? Nmap sometimes give false positive and the user agent can also be modified.Dhcp probes /device sensor too is not helping that much or maybe am just missing something in there Just wondering what solution is out there without using an agent. Probably an attribute that distinguishes different OS versions. It works fine for domain joined machine but I am interested in knowing how others are addressing non domain PCs running microsoft windows.

Xtreme

Re: Microsoft windows profiling

paul — Mon, 30 Sep 2019 15:33:11 GMT

Yeah this a tough one. As you said NMAP OS detection is unreliable. The only reason the domain joined ones are correct is because the OS attribute is pulled from AD via the AD profiler. The only other reliable way I know of is doing posturing, but I am guessing performing posturing on these devices is not an option.

I run across this a lot in the medical field. The client will have Windows XP machines provided by a vendor doing a critical function in their network.

What issue are you trying to solve by knowing the OS?

Re: Microsoft windows profiling

paul — Mon, 30 Sep 2019 15:34:12 GMT

Just thought of one thing you could try. You could possibly try an SMB NMAP probe against the machines to see if you can pull OS data that way.

Re: Microsoft windows profiling

xtreme — Tue, 01 Oct 2019 05:57:42 GMT

Thanks for the info Paul. Am trying to block win 7 machines from gaining access in the future but need to identify them first. My concern with the SMB feature is that once NMAP is enabled it automatically start scanning all the unknown endpoints which can be resource intensive. I also know the Nmap scanning can be triggered when the device hit a specific profiling rules (generic microsoft rule).... is there a way to first disable the auto scanning ? so Nmap will only kick in when the profiling rule is matched.

Thanks for the response.

Xtreme