Prevent network access of NOT up-to-date Windows client (SCCM)

[Marcus Hunold]

What is the answer of Cisco to the following situation/need:

A Windows client was offline for one month.

During this month a lot of critical patches were roll out by SCCM server.

(The client does not know it of course because it was offline)

How do I prevent this NOT up-to-date client to access the network (by AnyConnect)?

[balaji.bandi]

Not sure what is your environment, you can do a posture check here, and make sure the client is up to-date before use can get on to network and start working.

[Marcus Hunold]

My focus is not to define a cisco technology.

Because I have invested a lot of time in your suggested technology.

A good guide was how-to-integrate-cisco-ise-with-microsoft-sccm-for-patch 

And what I feel and read there is no possibilty to fullfil the initial explained requirement with posture ise.

Please correct me or confirm or provide a Cisco technology what can do that.

PS: My environment - SCCM5.x , ASA with newest AnyConnect , Windows 10 Client with AnyConnect (Client, Compliance, Posture ISE, DART)