Solved: How to Configure ISE posture to check windows 10 is running the latest update

Drthrax · ‎03-10-2020

Hello guys ,

How can I configure ISE 2.6 posture to check that windows is running the latest update otherwise it will mark the endpoint as non-compliant.

Mike.Cifelli · ‎03-10-2020

Step by step deployment can be found here: https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273
Leveraging a reg key to accomplish your goal would require you to update the key when new OS versions are released. The good thing is that you can support a check for multiple versions by utilizing the greater than or equal to condition. Check out labminutes.com as well for free vid tutorials.

View solution in original post

Mike.Cifelli · ‎03-10-2020

One option is via reg check: SOFTWARE\Microsoft\Windows NT\CurrentVersion\
You will need to determine the value data for the key and the corresponding version you wish to target. I currently use this in our environment and works great. You can do greater than or equal to, etc. HTH!

Drthrax · ‎03-10-2020

Can you please elaborate how did you do that , step by step .
In addition in your case don't you need to change the reg info on ISE everytime we have a new windows update ?

Mike.Cifelli · ‎03-10-2020

Step by step deployment can be found here: https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273
Leveraging a reg key to accomplish your goal would require you to update the key when new OS versions are released. The good thing is that you can support a check for multiple versions by utilizing the greater than or equal to condition. Check out labminutes.com as well for free vid tutorials.