Fundamentally, if you want to make sure the client system that connects to your network service running the software/configuration you want unmodified, you want

Fundamentally, if you want to make sure the client system that connects to your network service running the software/configuration you want unmodified, you want some help from the client to provide some cryptographic attestation and hope the keys cannot be physically extracted from the TPM chip to forge that proof in some other way. Now, let's say you have a policy that bans USB ports or requires some corporate spyware/antivirus to run and not get disabled by the user or else... this is the sort of stuff that IT desires.