topic Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE in Network Access Control

CSCwk64033 - Need support for windows update agent 1219.x in ISE

Fernando Segura — Wed, 07 Aug 2024 11:36:30 GMT

Hi all,

Same problem happened with 1218 version few months ago. I can not ask to my users to downgrade his windows 11 so i put this requirement as optional until Cisco upgraded the ISE and included v1218 support , but now it is happending again.

Is there any other way to check windows update compliance without wait until Cisco upgrade ISE to support Windows update agent 1219?

checking some regedit value reflecting windows security state, by example?

TIA

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

ahollifield — Tue, 06 Aug 2024 15:21:06 GMT

Do you have the latest Posture Feed update installed?

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

Fernando Segura — Wed, 07 Aug 2024 09:16:15 GMT

Yes, the latest posture feed already include support for Windows update agent 1219.x , but it needs upgrade compliance module to 4.3.4164.6145.

Some of our users didn't have admin rights and couldn't upgrade the module and we have to upgrade manually, this is why i am looking for an anternative method to check windows update running.

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

Fernando Segura — Wed, 07 Aug 2024 09:15:41 GMT

The predefined Cisco Conditions -> Service -> pc_AutoUpdateCheck working fine to check windows update running without check a specific version; but i a still need check if the windows has updated his critical patches

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

ahollifield — Wed, 07 Aug 2024 13:11:44 GMT

Updating the compliance module via ISE doesn’t automatically download and update? In my experience this doesn’t need admin rights.

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

Fernando Segura — Thu, 08 Aug 2024 08:49:20 GMT

@ahollifield , updating via ISE works fine in almost all computers, with admin users and with no admin users, but some computers fails, and in those cases, only if a admin user log in the computer the compliance module update fine.

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

Fernando Segura — Mon, 12 Aug 2024 08:40:28 GMT

This weekend Microsoft upgraded again Windows 11 and now use Windows Update agent 1220.x, but cisco ISE is not supporting yet.

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

luwhelan — Wed, 21 Aug 2024 02:56:08 GMT

@Fernando Segura support for Windows update agent is now available: Support Charts for Cisco Secure Client Windows Compliance Module v4.3.4214.8192

Please note you will need to install the latest compliance module version 4.3.4214.8192: Secure Client 5 Release ISEComplianceModule. As well as update the posture feed in ISE.

Re: CSCwk64033 - Need support for windows update agent 1219.x in ISE

Fernando Segura — Wed, 21 Aug 2024 06:50:00 GMT

Thanks you. I've updated and check and works fine. I've configured different rules for Win10 and Win11. Now Win11 devices will upgrade inmediately from ISE when new module is available, and Win10 devices will be upgraded by SCCM ( to aovid the need of users with admin privileges to install the compliance module updated).