Upgrade to Windows 10 Build 1803 - Cisco AnyConnect Incompatible

[umair9001]

Dear All,

We are trying to upgrade machines which are on Windows 7 SP1 (x64) to Windows 10 Build 1803 which was released recently but the setup doesn't let us proceed till we remove the NAM component. Further more, as per our tests, we noticed that we need to remove all the Cisco AnyConnect Components, like ISE Posture, Posture, GINA, etc. since even the Secure Mobility Client needs to be removed as it is associated with a VPN Network Adapter (Filter Driver). Below are the version we have already tried:

1. CAC v4.4.03034

2. CAC v4.5.05030

3. CAC v4.6.00362

Once you remove the Cisco AnyConnect completely, we are able to successfully upgrade the machine without any issues but this is a big overhead, Any advise/ideas?

[demason]

AnyConnect Compatibility with Microsoft Windows 10

AnyConnect 4.1MR4(4.1.04011) and later are compatible with Windows 10 official release. Technical Assistance Center (TAC) support is available beginning on 7/29/2015.

For best results, we recommend a clean install of AnyConnect on a Windows 10 system and not an upgrade from Windows 7/8/8.1. If you are planning to perform an upgrade from Windows 7/8/8.1 with AnyConnect pre-installed, make sure that you first upgrade AnyConnect prior to uprading the operating system. The Network Access Manager Module must be uninstalled prior to upgrading to Windows 10. After the system upgrade is complete, you can re-install Network Access Manager on the system. You may also choose to fully uninstall AnyConnect and re-install one of the supported versions after upgrading to Windows 10.

This is taken from AC 4.6 Release notes here: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect46/release/notes/b_Release_Notes_AnyConnect_4_6.html#reference_A63E6B4B06D949CAB56BB24EF9B28F4A

[umair9001]

Hi @demason,

I understand the Cisco TAC recommends to remove the CAC prior to upgrading any version of Windows, but this is a big overhead in terms of going with MAB Authentication during the upgrade phase since Cisco Anyconnect is responsible for providing the network connectivity and post removal, the network connectivity is completed stopped unless MAB is present. It even poses a risk of MAC spoofing if we keep the MAB always on the clients since upgrades are being rolled out twice yearly. I believe Cisco should work with MS to have a better compatibility when performing the Windows Upgrade with AnyConnect Installed.