How do ISE check the windows defender definition date?

[Xuennn]

I have set the condition "the definition date cannot be >1 system date and the remediation is set to auto.

However, when user connected to the network (definition date >1 day), it shows the error in anyconnect (the remediation you are attempting has reported an internal error. if the problem persists please contact your system administrator) What could be the issue?

[MHM Cisco World]

your run Posture ?

If Yes then the OS of client send all detail to ISE 
ISE then check with policy you set 

MHM

[Marcelo Morais]

Hi @Xuennn ,

 1st, double check the Error Message at Work Centers > Posture > Reports > Reports > Posture Reports > Posture Assessment by Endpoint, for more info.

 2nd, double check your Posture Configuration

At Work Centers > Posture > Policy Elements > Requirements

At Work Centers > Posture > Policy Elements > Remediations > Anti-Malware

At Work Centers > Posture > Policy Elements > Conditions > Anti-Malware

Hope this helps !!!