topic Re: Block Windows 7 in General Topics

Block Windows 7

LCMember190 — Tue, 05 Dec 2017 18:19:47 GMT

I am trying to block Windows 7 clients from accessing the internet. I have followed the steps here: https://live.paloaltonetworks.com/t5/Configuration-Articles/Custom-vulnerability-signature-for-identifying-Windows-XP/tac-p/72273#M1496

but I am unclear on what to set for the Pattern. Any suggestions/help to accomplish that goal will be appreciated.

Re: Block Windows 7

rmfalconer — Tue, 05 Dec 2017 22:26:34 GMT

Windows 7 is NT 6.1. You could start there.

Maybe User-Agent:.+Windows NT 6.1|User-Agent:.+Windows 7

You could also probably using something like Fiddler to inspect the http headers also and get the string from there.

Re: Block Windows 7

SteveO808 — Tue, 16 Nov 2021 22:11:48 GMT

Just tried this and got a false positive from a Windows 10 machine

Re: Block Windows 7

BPry — Wed, 17 Nov 2021 01:09:37 GMT

@SteveO808,

User-Agent strings can be set separately and aren't absolute indications that the machine is running Windows 7. Running things in compatibility mode for instance can change the User-Agent string automatically. It's likely that this is a "false positive" in the sense that the machine isn't running Windows 7, but it was sending the User-Agent string associated with Windows 7.