cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3869
Views
0
Helpful
1
Replies

Cisco AnyConnect and Windows Defender Application Guard

t3rebello
Level 1
Level 1

Hello folks,

Our organization recently deployed WDAG (Windows Defender Application Guard) and we have noticed an intermittent error on our user machines when launching Cisco AnyConnect. The error they are getting is "Posture Assessment Failed: Hostscan CSD prelogin verification failed".

When digging into the DART logs, we found that our Hostscan CSD package is not loading correctly due to an issue with the Internet Connection Sharing service being enabled. When disabling the Internet Connection Sharing service in Windows, the user is able to connect without an issue.

Here's the catch!

According to Microsoft, the Internet Connection Sharing service must be enabled for WDAG to work properly:
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-application-guard/faq-md-app-guard

Whereas Cisco AnyConnect is clearly looking for that same service to be disabled:
https://community.cisco.com/t5/vpn/error-in-anyconnect-client-installation/td-p/2619724

According to the previous post from Kanwaljeet in the Cisco link, the Internet Connection Sharing service must be disabled.

Is there any way to get AnyConnect to work reliably with ICS enabled, or have you folks heard of any way to allow WDAG to work with ICS disabled?

We seem to be stuck between a rock and a hard place, as our organization is greatly interested in the security features provided by WDAG.

Thank you
-Travis R.

Additional information:
Cisco AnyConnect version 4.9.01095
Hostscan 4.8.03036
Windows 10 Build 2004

1 Reply 1

t3rebello
Level 1
Level 1

Bump

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: