Temporal Agent Check for Windows Hotfix/Patches

[Jimi]

Hi All, May I have a confirmation if Temporal agent on ISE supports windows hotfix check? It says below that web agent for windows supports but temporal agent for windows doesn't;

However, isn't temporal agent the same as the web agent for windows?

[Jason Kunst]

Our product marketing team said this was also asked on their internal mailer? They are still researching

[Jimi]

Hi Jason, Thank you for the prompt response. Perhaps I should rephrase my question. As of ISE2.1, can we confirm that the web agent supports windows hotfix checks? It’s stated as yes in the 2.1 documentation: https://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_010110.html#ID443 Temporal agent was introduced in 2.2 and does not support the above so if ISE 2.1 web agent can do the job then I’ll be recommending my customer to use ISE 2.1

[Jason Kunst · Accepted solution]

Please see this document - https://community.cisco.com/t5/security-documents/ise-posture-deployment-guide/ta-p/3680273#toc-hId--966620850

I confirmed with our SME it should work unless a bug. Did you try it out?  Please recognize it simply checks but does not remediate. the user has to do that manually.

[Jimi]

Hi Jason,

Thank you so much again for the prompt reply. May I also confirm if there's a procedure to check/ensure the windows endpoint is always up-to-date in regards to the patches and not just file checks on individual hotfixes?

[Jason Kunst]

IT will check everytime the user logs in. To check consistently you will need to use the persistent agent (anyconnect) which can checking using PRA (Periodic assessment)