User Agents can be spoofed.  Easily.  Trivially.
> I don't think snort is the best for this though. If it is actual attacks you are better off looking at detecting attacks from existing sigs that are out there.
> If you don't mind me asking so we can understand what you are trying to get to: why is it you want to detect Windows machines on your network? If it is enforcement I would look at making the case for other tools such as packetfence http://www.packetfence.org/home.html but I will try and think of something if you let me know what you hope to achieve with this so I understand what you need to look at.
In OpenSource land, p0f is the best tool to go about detecting OSes.
> I am trying to create an alert rule to detect the OS but everytime I try it it seems not to work.