Software installation requirements to do host scan and posture assessments?

[webabc123]

We have devices using AnyConnect 4.x for VPN. We want to start finding and screening out unmanaged devices.  

I have heard that configuring posture assessment to check devices for existence of certain files, installed software or registry keys can be done before allowing network access. 

It looks like this requires additional software to be installed (posture or compliance module) besides the AnyConnect client before the devices can be checked. 

If the AnyConnect client for Windows is already installed, can the head end ASA push the additional modules to the device using the elevated system privileges of the Cisco service account running on the system (like it does when upgrading AnyConnect versions) or does the logged in user have to have administrator privileges for the module to be installed?

[Marvin Rhoads · Accepted solution]

Adding modules (like Hostscan for ASA-based posture assessment) to an existing AnyConnect client installation can be done from the ASA headend and does not require the end user to have local admin privileges.