topic Re: Posture "File Condition" for File Existence in System32 in Network Access Control

Posture "File Condition" for File Existence in System32 does not work

rezaalikhani — Tue, 24 Sep 2024 16:56:00 GMT

Hi;

Consider the following scenario:

Now, if I change the above configuration and create the same file (Watermark.txt) in "C:\Windows" or elsewhere like "Desktop", everything works as expected!!!

My current environment:

Windows 10 22H2
ISE 3.2 patch 6
Latest version of Cisco Secure Client and ISE Compliance Module

Any ideas?

Thanks

Re: Posture "File Condition" for File Existence in System32

ahollifield — Wed, 25 Sep 2024 13:30:59 GMT

Permissions issue? Also watermark files are a "security by obscurity" strategy that is not really effective. You should match on something else. What is the use-case for the watermark file?

Re: Posture "File Condition" for File Existence in System32

rezaalikhani — Thu, 26 Sep 2024 07:12:26 GMT

Thanks for your reply;

The "Watermark.txt" is just an example. I actually want to check the existence of some files for the client's installed antivirus which is not supported by ISE Compliance Module yet.
I have tested this situation with two distinct Windows 10 22H2 with exactly same result.

After some through testing, I found out when you choose absolute path for the desired file in a location, everything works Ok unless in the System32. As @ahollifield suggestion for possible permission issues, I used the Process Monitor utility from Microsoft to find any "Access Denied" events when checking the file existence in System32, without any considerable event:

Then, I selected the "SYSTEM_32" from File Path section as follows:

Violla! With this configuration change, everything worked as expected but anyway, seems a nasty bug in Cisco Secure Client...