ISE 2.2 SCCM remediation

[Attila Horvath]

Hi,

We have implemented ISE 2.2 with latest patch.

We would like to use client based (not MDM) SCCM posture with remediation.

At our customer the Windows patch installation process is the following:

When the patch arrive form MS, the IT assign this patch to computers (T day) in SCCM.

The users have 2 days to install these patches (now they can see its on workstation's software center),

and only after 2 days will force SCCM the installation.

So if we want to check, and remediate SCCM - we have 2 days when users allowed to exist without patches.

But in posture rules there is no any setting to allow grace period. So if patch assigned to machine,

the user will be non-compliant immediately.

So what is the proposal for this issue at ISE 2.2?

Attila

[Jason Kunst]

Confused how this is issue? ISE simply checks if the client is compliant with sccm policies correct? It’s a all or nothing value right? At a macro level? If sccm Policy allows grace period then wouldn’t it be compliant until that grace period is up?

You are not using specific compliance check for the micro level values directly from AnyConnect so don’t see how this would be an issue ?

[Attila Horvath]

Hi,

The issue to me is how to allow login for 3 days if the customer's policy allows 3 days to install patches. The SCCM query with Anyconnect (via SCCM API) shows user as Noncompliant, but I must allow login for a limited time (according corporate policy.)

I know we can force the remediation immediately, but this customer is not a Campus like, and force 800 user to install the whole Patch Tuesday in the morning, - and we cannot allow to work until installed -   is not a case.

[Jason Kunst · Accepted solution]

This is a public forum please do not talk about future features in this forum in case they are not committed to the release for some unforeseen reason

Unless there is a setting under SCCM  to allow a grace period on their side I don’t think this will work

Since we just check at the macro level with the external provider then it would have to send back to compliant for the specific condition

I have asked our posture SME imbashir To take a look at this thread to make sure I’m not missing anything

[Jason Kunst]

I just spoke to imbashir and he confirmed and gave some info as well.

From ISE we cannot set a grace period. This is a future request (we don't talk about futures in public forums).  Perhaps you can do a check that doesn't specifically call out a specific patch? Does SCCM offer a grace period if you are checking for GENERAL COMPLIANCE across all patches?

Besides that would ask a Microsoft SCCM expert.