Clay,

One thing you could potentially do is to allow traffic to
*.microsoft.com in the Unauthenticated Role?  Unless, of course, the
updates require the user to go elsewhere. 

-Rajesh. 

-----Original Message-----
From: Cisco Clean Access Users and Administrators
[mailto:[log in to unmask]] On Behalf Of Caldwell, Clay
Sent: Thursday, October 19, 2006 9:57 AM
To: [log in to unmask]
Subject: Re: IE7 Final is available now - question about CCA Rules

Some initial testing here.  I note the upgrade process requires
additional content to be downloaded after reboot, but before users can
authenticate (or even see a desktop).  Thoughts on how this will affect
users trying to run the upgrade while in a CCA environment?  In our
configuration, users are prevented from accessing the network (or
internet resources) before they authenticate to CCA (other than
receiving an IP address).

If users can not authenticate and can not cancel the upgrade once begun,
how can we allow the affected machines to actually complete the upgrade?


Clay Caldwell
Helpdesk Manager
Computer and Information Services
Phone: 206-281-2982
Email: [log in to unmask]
Web: http://www.spu.edu/CISHelpDesk/

-----Original Message-----
From: Perfigo SecureSmart and CleanMachines Discussion List
[mailto:[log in to unmask]] On Behalf Of ResNet-Info
Sent: Thursday, October 19, 2006 6:15 AM
To: [log in to unmask]
Subject: IE7 Final is available now - question about CCA Rules

Internet Explorer 7 Final is available now on Microsoft's website -
http://www.microsoft.com/windows/ie/downloads/default.mspx

I'm a bit curious about how the rules in CCA will work now.  Currently
with Windows XP SP2, CCA does a 'if SP2, then check for these updates'
or 'if non SP2, check for these different updates' because Windows
Update makes different updates available based on if you have SP2 or
not.  Will CCA be doing the same with Internet Explorer?  We already ran
into the problem where if you had and IE7 Beta installed and ran Windows
Update, some IE6 updates that CCA required wouldn't be listed as
available, and when you try to manually install them, Windows won't let
you.  The students had to uninstall IE7, install the IE6 patches, then
install IE7 again.

So I'm hoping that there will be a similar thing for IE like there
currently is for SP2. Is that going to be the case?

Also, since MS is going to (or already has?) require SP2 and do no
further updates for non-SP2 PCs, will CCA be dropping the SP2/non-SP2
conditions?

Thanks!

Doug Chudzik
ResNet Manager
Wellesley College