Patch Mgmt

[obliks00]

Hi, 

ISE have posture condition for patch management, (up to date, check for missing critical patches).

The windows update agent version is 1510.x. Not on the ISE GUI Selection.

Do we need to allow internet access to online MS servers for WUA?

Any inputs would be great help. 

Thank you.

[ahollifield]

Why not use MDM-based posture instead? Also what do you mean by "not available in ISE 3.3"?

[george661953]

SCCM is not necessarily required just to check Windows patch compliance. ISE posture can evaluate patch status on the endpoint through the Windows compliance module.

If you are using WSUS/SCCM for patch management, ISE can work with that environment, but it is not simply a requirement for the posture check. The endpoint still needs access to whatever update service it uses (Microsoft Update, WSUS, or SCCM).

Also, ISE 3.3 uses the newer compliance modules, so the available Windows Update Agent versions/conditions may differ from older ISE releases. I would verify the current ISE 3.3 compliance-module support chart rather than relying on the old 1510.x condition.

[Gagandeep Singh]

@obliks00 Cisco ISE patch management can check compliance either by integrating with Microsoft SCCM or by allowing the Windows Update Agent to connect to Microsoft's online update servers. SCCM integration provides centralized patch data for posture assessment, while internet connectivity is required if SCCM is not used to validate and remediate missing patches. Cisco recommends using patch management conditions and remediation over relying solely on WSUS APIs for better reliability.

Summary: You can use SCCM integration or internet access to Microsoft update servers for patch compliance checks in Cisco ISE posture. Both methods are supported, with SCCM offering a more managed approach

Hope this helps!!!