Posture "File Condition" for File Existence in System32 does not work

[rezaalikhani]

Hi;

Consider the following scenario:

Now, if I change the above configuration and create the same file (Watermark.txt) in "C:\Windows" or elsewhere like "Desktop", everything works as expected!!!

My current environment:

• Windows 10 22H2
• ISE 3.2 patch 6
• Latest version of Cisco Secure Client and ISE Compliance Module

Any ideas?

Thanks

[ahollifield]

Permissions issue?  Also watermark files are a "security by obscurity" strategy that is not really effective.  You should match on something else.  What is the use-case for the watermark file?

[rezaalikhani · Accepted solution]

Thanks for your reply;

• The "Watermark.txt" is just an example. I actually want to check the existence of some files for the client's installed antivirus which is not supported by ISE Compliance Module yet.
• I have tested this situation with two distinct Windows 10 22H2 with exactly same result.

After some through testing, I found out when you choose absolute path for the desired file in a location, everything works Ok unless in the System32. As @ahollifield suggestion for possible permission issues, I used the Process Monitor utility from Microsoft to find any "Access Denied" events when checking the file existence in System32, without any considerable event:

Then, I selected the "SYSTEM_32" from File Path section as follows:

Violla! With this configuration change, everything worked as expected but anyway, seems a nasty bug in Cisco Secure Client...