topic Pre-login posture assessment - possible with ISE? in Network Access Control

Pre-login posture assessment - possible with ISE?

Phillip Macey — Mon, 11 Mar 2019 05:29:15 GMT

Does anyone know if it is possible (or not) to have a windows machine posture assessed on boot? ie. before anyone logs in on it. Currently, I have to log in on my machine before the assessment starts. It would be good to have assessment begin as soon as the machine boots so that (assuming the machine passes assessment) it is completed by the time I log in. We are using the NAC Agent with ISE1.2.

Thanks in advance for your thoughts.

What things where you

jan.nielsen — Tue, 24 Feb 2015 21:57:16 GMT

What things where you thinking you could check when the machine is booting ?

Stuff that is not (I assume)

Phillip Macey — Tue, 24 Feb 2015 22:08:44 GMT

Stuff that is not (I assume) dependent on the user logging in. eg. AV is installed (and running?), some registry keys.

As far as i know, the posture

jan.nielsen — Wed, 25 Feb 2015 00:14:03 GMT

As far as i know, the posture agent does not do anything before user has logged in, i have never seen a posture report in ise, that indicates anything else, because you would get many failed posture compliance checks, if it did (checking user keys, user files, av status and so on in machine land).

It is not possible. The

nspasov — Thu, 26 Feb 2015 01:28:07 GMT

It is not possible. The Windows Logon process and similar functions happen before the NAC/Posture agent starts/loads up.

Thank you for rating helpful posts!