This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 47%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
It seems running this update on my environment, updated my Windows Update Agent from a version of 1508 to 1509. This in turn caused an issue with Cisco ISE not recognizing this latest push and failing the client posture. I had uninstalled it from my workstation and ISE ran fine (posture correctly). Also due to the fact, Cisco does not carry the support for 1509.
Why would this be pushed out when not all applications designed to run on Windows are up to date as well or can support it? Does your agency converse with other agencies to ensure smooth transitions?
Here are my responses to your statements made below.
Hello @Robert
Thanks for the additional details. Your testing is useful, particularly since removing KB5101684 restores Cisco ISE posture functionality.
One clarification: while this demonstrates a compatibility issue in your environment between Cisco ISE/Posture and the Windows build introduced by KB5101684, we can't yet classify it as a Microsoft-known issue with KB5101684. Microsoft currently lists no known issues for this preview update.
KB5101684 is also a non-security preview cumulative update for Windows 11 24H2/25H2. Preview updates allow administrators and vendors to validate upcoming Windows changes before those changes become part of the regular servicing cycle.
Based on your testing, I would keep KB5101684 declined in WSUS for the affected Cisco ISE-managed systems for now.
Since Cisco ISE/Posture apparently doesn't yet recognize/support the resulting Windows build, I would also open a Cisco TAC case and provide:
That will help Cisco determine whether an updated OS-support definition, posture package, or Secure Client/ISE update is required.
Regarding Microsoft and third-party vendors: Microsoft provides preview releases specifically in part to allow organizations and software vendors to validate compatibility. However, Microsoft can't guarantee that every third-party application will already recognize a newly released Windows build. Compatibility support for Cisco ISE ultimately also depends on Cisco's supported Windows versions/builds.
Since you've reproduced the problem and identified KB5101684 as the trigger, it would be reasonable to report this through both Cisco TAC and Microsoft Support/Feedback Hub, especially if Cisco confirms that the issue is caused by a Windows behavioral change rather than simply an unsupported build.
Please don't forget to "Accept the Answer" if this information helped you. This will help us and others in the community as well.
My responses to yours:
Hi @Robert , As I stated above, it would be reasonable to report this through both Cisco TAC and Microsoft Support/Feedback Hub, especially if Cisco confirms that the issue is caused by a Windows behavioral change rather than simply an unsupported build.
Hello @Robert
Please let me know if you need any further assistance. Otherwise, if the information provided has resolved your issue/answered your query, please consider clicking “Accept Answer” to help others who may encounter the same problem.
Thank you!
Hello @Robert
KB5101684 is an optional non-security preview cumulative update for Windows 11 24H2/25H2, released July 28, 2026. Microsoft also states that it can be manually imported into WSUS; it isn't included automatically as a WSUS image/update synchronization item.
Microsoft KB5101684 release notes: https://support.microsoft.com/en-us/servicing/os/windows-11/2026/07/july-28-2026-kb5101684-preview?
So if KB5101684 was deployed through your WSUS environment, I would first check how it was imported and approved, particularly whether Preview updates are being approved for production endpoints.
Regarding Cisco ISE, Microsoft can't guarantee that every third-party product will immediately support changes introduced by a Windows preview update. Cisco ultimately determines ISE/Posture compatibility with specific Windows builds and components.
Since uninstalling KB5101684 restored ISE posture functionality, that's useful evidence of a compatibility issue. I would recommend:
Microsoft currently lists no known issues for KB5101684, so the Cisco ISE behavior isn't presently documented as a known Windows issue.
Given your successful rollback test, I'd treat this as a Windows/Cisco ISE interoperability issue until either Microsoft or Cisco confirms otherwise.
Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.
