Without doubt, the single biggest problem we face with Clean Access is it 
disagreeing with Microsoft Update, as to the patch level of a Windows 
computer. MS Update says it's all patched, Clean Access says otherwise. 
It's a real burden on our support staff (and me - because they complain to 
me).

One of our Technical Staff suggested part of the problem might be 'rollup' 
updates from Microsoft, where a number of patches are packaged into one 
update. He suggested that the registry might not be updated in the same 
way applying an individual patch does. My question is - do the Clean 
Access rule sets supplied by Cisco take this into consideration? I've 
never been able to explain why re-installing the SUPPOSEDLY missing patch, 
updates the missing registry entries and fixes the issue.

-Mike