Block all traffic from Windows 7 devices

[NKL]

With the upcoming End of Support for Windows 7, I am looking for a way to block ALL communication initiated by Windows 7 devices passing through a Fortigate (FortiOS 6.0.6). I am aware of a Cookbook-recipe, that uses a custom IPS signature to block "browsing" of Windows XP clients, which could be easily adapted to Windows 7. But that is not, what I want, as I want to block any traffic all together. And I doubt that IPS will do the trick. Any ideas how to approach this?

[James_G]

Deploy FortiClient EMS endpoint security policy with fabric integration to FortiGate and deploy an automation stitch to quarantine non compliant machines