Acs 4.2 PEAP machine authentification wireless

Question

Hi,
here at work, we have acs 4.2 as our radius server, and 2 wlc 4404 with a wism2 for our wireless network. we have 2 SSID network, lets call them SSID A and B. A have a more restricted access to server than B.
PEAP machine authentification is authorize on both network, to let our users laptop connect before the user login, this enable us to have our computer gpo deploy before the user logon, or have network access to authenticate a user to our directory if he had not logon previously on the laptop.
Users from group A can't logon to SSID B, they can only logon to SSID A, but we have some clever users from group A who have change they wireless setting to only send machine authentification (this can be done in the advance setting of a wireless network in windows 7) to connect to SSID B
We can't force the wireless config by GPO because we don't have an ad 2008 domain, we are still in 2003 soo we can't change the gpo for windows 7 wireless setting (I'm a network guy, I'll have to check more on this to be sure...)
I can't force user to require machine authentification and user authentification because we have a lot of ipad and iphone, and other mobile device that connect using only their user credentials.
Is there a way I could configure this without having to disable machine authentification for SSID B?
thank you

Answer 1

hi thank you for the quick answer,
however we don't have machine access restriction, in the windows eap setting we only have enable PEAP machine authentification.
this is ok because we want our notebook to be able to have access to the wifi (for gpo) before the user logon and we want any user to be able to use their own device. we are a educationnal institute, we don't want to force the teachers and student to only use the equipement we provide we want to give them more power over their choice of equipement.
SSID A is the student network, and SSID B is the teachers network.
the problem we have is some student use their active directory joined computer to get access to the SSID B. If they use their user credentials they won't have access. and as user bring their own device we can't force an peap machine authentification because students and teachers are allowed to BYOD.
is there a way to restrict machine  (let's say in an OU) access to an SSID?