Is there any way to deny the access if a windows services is enabled on Cisco ISE?

[victormanuelsolis]

Hello Team,

I need to know if exist any way to deny the access to the network/VPN when a windows services is enabled? I mean I need to deny the access to all users who have the printer spooler enabled on Cisco ISE.

Thanks!

[balaji.bandi]

I think it is possible posture check (not tested myself)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_010111.html

http://www.labminutes.com/sec0279_ise_22_posture_assessment_anyconnect_client_3

[victormanuelsolis]

Thank you for your answer, but I didn't find how to apply the created condition to the policy, in this case is a windows service created under Work Centers->Posture->Policy Elements->Conditions->Service

[Mike.Cifelli · Accepted solution]

One you create the conditions you integrate them into posture requirements, which the requirements are then what is assigned in the posture policy.  Posture requirements contain a set of rules.  These rules include your configured posture condition, OS type, module/agent type and remediation action.  I strongly suggest taking a peek here as this will help: https://community.cisco.com/t5/security-documents/ise-posture-prescriptive-deployment-guide/ta-p/3680273#toc-hId-1324378478

HTH!

[victormanuelsolis]

Thank you Mike,

Unfortunately, in my current network design I cannot apply this solution to my request, due the users are pointing to the ASA to establish the VPN instead the ISE, so I guess I need to change a little bit the design in order to proceed. Thanks to all for your time !

[Mike.Cifelli]

You can absolutely do this with ISE posturing.  The solution has several components and it is rather complex to implement/deploy.  Your condition would look like this:

 I suggest taking a peek at what @balaji.bandi shared & the following:

ISE Posture Prescriptive Deployment Guide - Cisco Community

Good luck & HTH!