Updating Remote Computers Before They Get In Through VPN.

Have you tried looking at SUS? It's a MS product...Software Update Services. It check the PC's on your network and can be configured to automatically install any updates. SUS works like the MS update page from their site. Your SUS server will download header info. for all new patches that have been release by MS, and then you approve the patches and it gets downloaded onto your SUS server. You can then specify the settings in your Group Policy to ensure that the incoming PC's automatically download the patches and install and reboot. Only problem is they would have to be on your network for SUS to see them. So that doesn't really answer your question. Oh yes, and your need Windows 2K SP4, Windows XP SP1 or Windows 2K3.

Microsoft will offer a complementary technology, dubbed "NAP", in the next year or so as well:
http://www.microsoft.com/nap

Until then, the next best thing would be to use the RQS & RQC technologies that shipped with the Windows Server 2003 Resource Kit.  Start your reading here:
http://www.microsoft.com/technet/community/columns/cableguy/cg0203.mspx

Then check out the W2K3 documentation here:
http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/deployguide/en-us/dnsbf_vpn_aosh.asp

RQS download: http://www.microsoft.com/downloads/details.aspx?FamilyID=D4EC94B2-1C9D-4E98-BA02-B18AB07FED4E&displaylang=en

ISA integration with RQS: http://www.microsoft.com/downloads/details.aspx?FamilyId=3396C852-717F-4B2E-AB4D-1C44356CE37A&displaylang=en

[There's lots of resources at MS - just go to http://search.microsoft.com and search for "rqs".]

I won't tell you that this is an easy deployment, but then the problem you're trying to solve isn't easy to solve.  Most organizations I've worked with spend a ton of money trying to battle this, and no one gets it perfect.  Best you can hope for is to make a significant reduction on the number of infections that get into your network through the VPN channel.

To make a *real* impact on keeping your organization from being completely wiped out by the next infection, you should *also* focus a significant amount of attention on configuring your network, hosts and applications to protect your business critical data and services from *anything* bad on your network:
- Treat your network like it's as hostile as the Internet - don't assume that *any* other computer couldn't become infected and try to "attack" your critical servers
- ensure that you have a solid backup strategy for all your critical servers and data (and make sure that the backups can actually be used to recover your servers/data in case of a disaster)
- don't let any more than the necessary subnets communicate with the critical servers, and when VLANs or firewalls are already available, limit the protocols allowed as well.
- for Windows 2000 or later servers, configure IPSec "block" policies to only allow the ports (and IPs) you really need into the servers
- keep your servers up to date on their darned patches!  [SUS server is cheap insurance for this problem]
- lockdown the logon rights on the servers to just the groups that are needed to access these servers
- make *sure* that all users with logon rights are configured with strong passwords
- make *darned* sure that any service accounts configured on these critical servers are *not* used on the workstations, laptops, or physically insecure servers in your network

There's lots of other little things you can do, but these alone with *significantly* reduce the damage TO YOUR BUSINESS from worms on your network.  A few workstations infected won't (usually) take the company down, but your key database taken out for three days COULD.

I have novel authenticaton for windows so I cannot use SUS or any other windows stuff.
I will be using PIX for my firewall and VPN.
Can I use NAC from Cisco if yes do I need ACS and Radius server ???????
Other than the above scenerio do we have anything else to fill the same.