ISE posture - SCCM remediation for Symanetc AV installation

[dngore]

Hi,

Customer is using SCCM server for deploying Symantec AV on user systems.

It is known that ISE (Anyconnect client) can integrate with SCCM client for automatic remediation for windows patches.

Can same integration be used to install Symantec AV package automatically on system using SCCM agent?

Customer is looking for automatic way to remediate non-compliant system for symanetc AV installation.

[Aravind Ravichandran]

Hello,

Patch management is meant to check patch update & not for software installation.

In SCCM server, there are two catagories like software update & deployment package.

Symantec AV installation will be defined under deployment package & if any microsoft update is available it will show under all software updates.

Even if SCCM patch management is defined in ISE, It will check whether All/ Critical/important patches were installed.Symantec AV will not fall under patch management catagory & so it won't get marked as non-compliant even if symantec av is not present in patch management check.

Remediation is possible in case of windows patch not for software installation.

-Aravind

[paul]

For the Symantec AV check the posture module doesn't care how the software arrived on they system it is posturing.  You can configure a Symantec AV check using the Malware checks to ensure Symantec is installed, running and definitions are up to date.  The posture module can automatically remediate the running and definitions up to date conditions.  It cannot automatically remediate the not installed.

[Jason Kunst]

I would think at a macro level SCCM could perhaps call this out as a requirement. If ISE asks SCCM its status and its not compliant then the anyconnect will request SCCM to update?

[Nidhi · Accepted solution]

Hi DMG, 

As we discussed on the phone today, want to update this thread for closure. 

Symantec patches cannot be installed with SCCM client. SCCM client is for Microsoft patches. You will have to identify the symantec agent running on the endpoint to do the patch management.

Regarding the existence of any AV software in the endpoint, you can create a file/registry /service condition. The remediation is limited to messaging to the user to install it from a specified link if the AV is missing. 

We also discussed about using the policy configured in SCCM server, to check for the compliance status. however, in case of non-compliant status, we cannot deploy a package from SCCM server via ISE.

Thanks,

Nidhi