topic Re: Cisco NAC Agent Uninstall GPO script in Network Access Control

Cisco NAC Agent Uninstall GPO script

mnabeel@ciso.com — Sat, 05 Mar 2016 12:50:41 GMT

I am searching for a Microsoft GPO script to uninstall the NAC Agent across the enterprise users. Do we have any such script recorded in past ?

Re: Cisco NAC Agent Uninstall GPO script

Timothy Abbott — Mon, 07 Mar 2016 15:24:33 GMT

Muhammed,

I did some internal searching and was unable to find a GPO script that would remove NAC agent from domain computers. In case you weren’t aware, ISE can do this as part of a migration to AnyConnect posture provisioning.

Regards,

-Tim

Re: Cisco NAC Agent Uninstall GPO script

mnabeel@ciso.com — Mon, 07 Mar 2016 20:53:43 GMT

Hey Timothy,

I am aware of the option that we can specify the uninstall option on Anyconnect Profile defining on Cisco ISE. I 've tried this option, where the test PC contains Anyconnect (NAM + ISE Posture) already installed manually and i was expecting when ISE Posture starts system scan it will uninstall the Nac Agent but didnt get success. What's the proper way to uninstall that through Anyconnect ?

Re: Cisco NAC Agent Uninstall GPO script

Timothy Abbott — Wed, 09 Mar 2016 16:27:02 GMT

Hi Muhammad,

Removal of the NAC Agent during AnyConnect posture assessment doesn't work in that manner. The AnyConnect installer would remove the NAC agent during an initial installation or upgrade process.

Regards,

-Tim

Re: Cisco NAC Agent Uninstall GPO script

mnabeel@ciso.com — Wed, 09 Mar 2016 16:40:07 GMT

Thanks Tim,

so the initial installation/upgrade must be during CPP state? or i can run standalone installation that may include xml file that enforce Nac agent uninstallation ?

Re: Cisco NAC Agent Uninstall GPO script

Timothy Abbott — Wed, 09 Mar 2016 16:52:51 GMT

No worries. I’m 99% sure it has to be done during the provisioning process. This best way to find out would be to test in a lab environment.

Regards,

-Tim