Technical Tip: How does EMS tag client for Windows OS versions check

[jie]

Description	This article describes how EMS checks the client's Windows OS version when it tags the client.
Scope	FortiClient EMS, FortiClient.
Solution	Once configured, EMS ZTNA tags to check Windows OS version and update status. FortiClient retrieves the information from Windows Event log, looking for the most recent event ID 19 or 216 with the keyword 'KB(number)' from Event Viewer, and gets the time of it, as shown below: This can always be verified under Event Viewer -> Windows Logs -> System log.  If there is no Windows KB installed recently in the configured 'x' days (in the below example, it is 7 days), then it will not match the rule set. Event ID 19: This event means a Windows Update has been successfully installed. Event ID 216: This is also related to Windows Update installation activity, sometimes used for servicing events.