This can happen throughout the year, too - where one patch will include
sub-patches but not touch the registry, and users will be told they have
no new updates, but CCAA insists they need to update.

Use the CAM to look at the particular user and see what check they're
failing. Be forewarned: failure terminates the check, so after applying
one KB patch, attempt to log in again because there may be several more
updates yet to install.

--Joey Mavity
Azusa Pacific University

 > -----Original Message-----
 > From: Cisco Clean Access Users and Administrators
 > [mailto:[log in to unmask]] On Behalf Of Eric Kenny
 > Sent: Tuesday, March 25, 2008 7:13 AM
 > To: [log in to unmask]
 > Subject: [CLEANACCESS] 4.1.3.1 - Some Vista SP1 Users Not Compliant?
 > 
 > Hi everybody,
 > 
 > We just rolled out our NAC to all residence halls over spring break.
 > It seems Microsoft released SP1 for Vista around the same time.
 > Anyway, long story short, using the Cisco rules for critical Windows
 > patches, users who upgraded directly to SP1 without installing the
 > previous patches are failing on the following updates:
 > 
 > KB941644_MS08-001
 > KB932168_MS07-020
 > KB930178_MS07-021
 > KB935840_MS07-031
 > KB929123_1_MS07-034
 > HotFix908519
 > KB939840
 > KB939839
 > KB928843
 > KB920219
 > 
 > We know that SP1 encompasses these issues, so anyone with SP1 should
 > be allowed on, but is not.  Is anyone else experiencing this?  If so,
 > what did you do to get your users online?
 > 
 > Eric J. Kenny
 > Network Analyst
 > Marist College
 > 3399 North Rd.
 > Poughkeepsie, NY 12601
 > 845.575.3820