ClearPass - Network Access Control (NAC) based on Windows Client OS Version and Build number

How to manage Windows client network access based on their OS version and build number in CPPM Enforcement Policies

Summary:  for enforcement policy to be based on "Windows OS Build version" you will need to implement OnGuard, and via the Health Check Service you will be able to witness the Windows Build version.  You will need to create a new Endpoint record to store these details, then create an Enforcement Profile to store the information in the EndpointDB.  From there you can then use roll mapping policies that reference the build number in your services.

From CPPM > Monitoring > Live Monitoring > Access Tracker > 

find a relevant Source = WEBAUTH, Service = Health Check Service record and open it to the Input tab

Scroll down to the Computed Attributes section, here you can find version information collected by OnGuard agent in the Endpoint such as:

Host:    OSArch            x86_64

Host:    OSName            Microsoft Windows 10 Enterprise Edition

Host:    OSNameVersion     Microsoft Windows 10 Enterprise (10.0.17134)

Host:    OSType            Windows 10

The below steps help in creating the required configuration to access the Windows build number. 

From Administration > Dictionaries > Dictionary Attributes > create a new Endpoint attribute as below.


From Configuration > Enforcement > Profiles > create a new enforcement profile of type "Clearpass entity update enforcement" to update the endpoint table with OS version info.

Endpoint > OSNameVersion > %{Host:OSNameVersion}
Update the Posture check service > Enforcement policy to use the endpoint update enforcement profile (created above).


Update the Radius authentication service > Enforcement policy to check the endpoint table OSNameVersion attribute value for selecting the enforcement profile response.

I would like to give credit to Nimal Varampetran for posting the the template for this solution on Airheads on April 21, 2021.