Abstract: An apparatus includes a processor and a memory operatively coupled to the processor. The processor is configured to automatically send queries to client devices, and to receive responses from the client devices in response to the queries. The processor is configured to identify, based on the responses and on role information stored in an Active Directory database, roles of current users of the client devices and identify based on the roles security risks associated with the client devices. The roles can differ among users. The processor is configured to select a remedial action for at least one of the client devices based on the security risk associated with that client device, and is configured to implement the remedial action on that client device. The processor is configured to not select a remedial action for another of the client devices based on the security risk associated with that client device.

Abstract: A method for detecting unmanaged nodes within a system is described. A flow of data associated with a node is detected, wherein a managed node detects the flow of data. Information relating to the node is discovered. A determination is made whether the node has been previously discovered. The identification of the node is recorded to a list if it is determined the node has not been previously discovered. The identification of the node is transmitted to a management device.

Abstract: A method for quarantining a node from other nodes in a network is described. A node is scanned to obtain a health posture of the node by determining if the node is compliant with one or more requirements. A current policy in accordance with the obtained health posture of the node is obtained. A previous policy is removed. If the node is determined to be non-compliant, a key that is unique to the non-compliant node is selected. The current policy is applied.