Mary, Actually, that check is incorrect. There are different versions for Vista & Vista SP1. You need 2 checks & some rule logic.
MS08-067_Vista: SYSTEM32\netapi.dll later than 6.0.6000.16763 MS08-076_Vista_SP1: SYSTEM32\ netapi.dll later than 6.0.6001.18156 MS08-067_Vista-rule: (pc_vista64)|((pc_Windows-Vista-SP1|pc_Windows-Vista-SP1-int)&(MS08-067_Vista_SP1))|(MS08-067_Vista) When I last checked this afternoon, Cisco still did not have their check published. What happened to the commitment to publish within 48 hours of patch release?? Do we get paid for writing Cisco’s checks for them? Bruce Osborne Liberty University From: Cisco Clean Access Users and Administrators [mailto:[EMAIL PROTECTED] On Behalf Of Mary-Ellen Ide Sent: Friday, October 24, 2008 3:09 PM To: [email protected] Subject: Re: [CLEANACCESS] Microsoft Patch I have created the rule for Vista and XP, and set the requirement up as an “audit”. I patched Vista and it failed the audit check (see attachment). Has anyone been able to get this working with Vista? I checked the netapi32.dll and it is version 6.0.6001.18157. I am in the process of patching Win XP and will then test that one….. Mary Ide Internet Security Engineer Johnson & Wales University SANS GCIH #1794 SANS GWAS #1728 [EMAIL PROTECTED]<BLOCKED::mailto:[EMAIL PROTECTED]> From: Cisco Clean Access Users and Administrators [mailto:[EMAIL PROTECTED] On Behalf Of Stanclift, Michael Sent: Friday, October 24, 2008 10:28 AM To: [email protected] Subject: Re: Microsoft Patch I setup the registry key below for XP, here is what I’m setting up for Vista. Not 100% sure if it will work but I don’t see why it wouldn’t. It checks for netapi32.dll file version 6.0.6001.18157 which is what my computer reported as being installed after the update. Getting ready to test it right now. (attached) Michael Stanclift Network Analyst Rockhurst University http://help.rockhurst.edu<http://help.rockhurst.edu/> (816) 501-4231 From: Cisco Clean Access Users and Administrators [mailto:[EMAIL PROTECTED] On Behalf Of bouchaiba Sent: Friday, October 24, 2008 7:45 AM To: [email protected] Subject: Re: Microsoft Patch Hi , Here are the registry keys for XP 1-Windows XP Service Pack 2 and Windows XP Service Pack 3: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP4\KB958644\Filelist 2-Windows XP Professional x64 Edition and Windows XP Professional x64 Edition Service Pack 2: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP Version 2003\SP3\KB958644\Filelist According to microsoft ,there are no reg keys for vista. -----Original Message----- From: Todd Joyce Sent: Oct 24, 2008 8:02 AM To: [email protected] Subject: Microsoft Patch Anyone figured out a check yet? Todd Joyce Radford University -- Todd Joyce [EMAIL PROTECTED]<mailto:[EMAIL PROTECTED]> Pain is the precursor of change
