topic Re: Temporal Agent Check for Windows Hotfix/Patches in Network Access Control

Temporal Agent Check for Windows Hotfix/Patches

Jimi — Thu, 13 Sep 2018 16:41:59 GMT

Hi All, May I have a confirmation if Temporal agent on ISE supports windows hotfix check? It says below that web agent for windows supports but temporal agent for windows doesn't;

However, isn't temporal agent the same as the web agent for windows?

Re: Temporal Agent Check for Windows Hotfix/Patches

Jason Kunst — Thu, 13 Sep 2018 17:49:34 GMT

Our product marketing team said this was also asked on their internal mailer? They are still researching

Re: Temporal Agent Check for Windows Hotfix/Patches

Jimi — Thu, 13 Sep 2018 18:27:53 GMT

Hi Jason, Thank you for the prompt response. Perhaps I should rephrase my question. As of ISE2.1, can we confirm that the web agent supports windows hotfix checks? It’s stated as yes in the 2.1 documentation: https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010110.html#ID443 Temporal agent was introduced in 2.2 and does not support the above so if ISE 2.1 web agent can do the job then I’ll be recommending my customer to use ISE 2.1

Re: Temporal Agent Check for Windows Hotfix/Patches

Jason Kunst — Thu, 13 Sep 2018 19:41:05 GMT

Please see this document - https://community.cisco.com/t5/security-documents/ise-posture-deployment-guide/ta-p/3680273#toc-hId--966620850

I confirmed with our SME it should work unless a bug. Did you try it out? Please recognize it simply checks but does not remediate. the user has to do that manually.

Re: Temporal Agent Check for Windows Hotfix/Patches

Jimi — Fri, 14 Sep 2018 01:11:43 GMT

Hi Jason,

Thank you so much again for the prompt reply. May I also confirm if there's a procedure to check/ensure the windows endpoint is always up-to-date in regards to the patches and not just file checks on individual hotfixes?

Re: Temporal Agent Check for Windows Hotfix/Patches

Jason Kunst — Mon, 21 Oct 2019 05:50:38 GMT

IT will check everytime the user logs in. To check consistently you will need to use the persistent agent (anyconnect) which can checking using PRA (Periodic assessment)