NAC works like this: Endpoints are configured to run with an agent or without an agent with some corresponding loss of compliance accuracy. These agents respond to queries initiated by the network to identify various attributes of their posture. This can include OS and hot-fix version number, the presence and configuration of a personal firewall, and the .DAT file version running on a systems AV software, as well as when it last ran a full scan. When an endpoint runs without an agent, the system is audited by the network to determine the relative risk level of allowing it on the network.