It's a trust issue with your client and ISE. There were talks about certificates in this forum, which is probably the root cause. I personally have not digged deep enough to figure it out. A quick workaround for me, and my end user's, is to simply disable the following:
This will surely work. Then the client will be able to run the downloader.
I think there were also some mentions about the version of the software that is installed. I don't think that really matters in this case. So long as there is a version mismatch between your end point and whatever the ISE policy is trying to configure, the provisioning policy of the ISE will attempt to push the software and execute it on your side. If you so happen to have the same exact version, then this "failed downloader" issue may never even happen. At least this is what I have gathered so far.
Hope this makes sense and helps.
