ISE Posture - Patch Management

[obliks00]

Hi, 

In ISE deployment, we have a posture condition for patch management, (up to date, check for missing critical patches).

The windows update agent version is 1510.x

This is not available on the ISE 3.3.

I would like to also confirm if we need to integrate SCCM server or if internet connection to online MS servers is required for the Windows update agent to check for the compliance for patches? 

Any inputs would be great help. 

Thank you.

[ahollifield]

Why not use MDM-based posture instead? Also what do you mean by "not available in ISE 3.3"?

[george661953]

SCCM is not necessarily required just to check Windows patch compliance. ISE posture can evaluate patch status on the endpoint through the Windows compliance module.

If you are using WSUS/SCCM for patch management, ISE can work with that environment, but it is not simply a requirement for the posture check. The endpoint still needs access to whatever update service it uses (Microsoft Update, WSUS, or SCCM).

Also, ISE 3.3 uses the newer compliance modules, so the available Windows Update Agent versions/conditions may differ from older ISE releases. I would verify the current ISE 3.3 compliance-module support chart rather than relying on the old 1510.x condition.

[Gagandeep Singh]

@obliks00 Cisco ISE patch management can check compliance either by integrating with Microsoft SCCM or by allowing the Windows Update Agent to connect to Microsoft's online update servers. SCCM integration provides centralized patch data for posture assessment, while internet connectivity is required if SCCM is not used to validate and remediate missing patches. Cisco recommends using patch management conditions and remediation over relying solely on WSUS APIs for better reliability.

Summary: You can use SCCM integration or internet access to Microsoft update servers for patch compliance checks in Cisco ISE posture. Both methods are supported, with SCCM offering a more managed approach

Hope this helps!!!