Cisco ISE Posture and OS Selections

[nikolaie]

Hi, We are in the process of deploying Posture Assessment across the business but would like to target only a particular flavor of Windows 10 Operating System, i.e., Enterprise, instead of ALL Win 10 versions.   This granular selection of the OS is required because we have hundreds of thin clients running Windows 10 Embedded so we'd prefer they do not participate in posture assessment.   Cisco ISE Version 2.6.0.156, Patch 3.

Question: Can the Client Provisioning Policy rules around Operating Systems be modified to include more granular versions of an OS type, i.e., Windows 10 Professional, Windows 10 Enterprise, etc.  These options are available when created a Posture Policy just not when creating a Client Provisioning Policy.  Thanks in advance.

[Mike.Cifelli · Accepted solution]

AFAIK for the CPP rules you cannot include more granular OS under the 'If' column. However, you have the ability to rely on 'other conditions' to ensure that you only steer the clients you wish to be subject to ISE posturing. Some examples include: rely on different AD security groups; tunnel group name identifiers from VPN profiles; along with many others. You can create conditions as well. My suggestion would be to identify which specific conditions you can utilize to keep Win10 Enterprise separate from the rest of the bunch. Good luck & HTH!

[nikolaie]

Thanks for the quick response.  Was hoping to avoid using AD security group but it may be the only option available. Thanks again.

[manvik]

Is there an option to identify endpoint operating system via Endpoints:OperatingSystem condition.

It's in the ISE posture conditions.

[Mike.Cifelli]

@manvik I would suggest testing that condition.  I can tell you that you can rely on the following reg key check to match on OS:

*SubKey = SOFTWARE\Microsoft\Windows NT\CurrentVersion\

HTH!