ISE and Microsoft AD machine authentication

Question

Hello Security masters,
my goal is to perform a PEAP authentication against Microsoft AD with the machine credentials of the Windows PC.
The question is, how my authorization policy looks like? From my understanding I have different possibilities to solve this:
1.) Directly referencing to the AD group, where the computer objects are stored:
If "Any" and <AD-NAME>:ExternalGroups equals <DOMAIN>/COMPUTERS then PermitAccess
Drawback: If I have multiple subdomains or if the computer accounts are stored in different OUs or groups, I have to check all of them (multiple rules or compound conditions)
2.) Username checking
If "Any" and Network Access:UserName STARTS_WITH host\ then "PermitAccess"
I'm checking if the username starts with "host\", which is normally an indicator for a machine/computer account
3.) Attribute checking
If "Any" and <AD-NAME>:servicePrincipalName STARTS_WITH host\ then "PermitAccess"
I'm checking the value of the "servicePrincipalName" of the AD. Normally only computers have this attribute and the value is "host\<PC-NAME>
Is one of these three approaches the right way to do it, or am I doing it completely wrong.
Is there a best-practice approach to do this? How did you guys solve this?
Best regards and thank you in advance
Johannes

Answer 1

Hi Neno,
thank you for your answer.
There are multiple domains in the forest and the computer / machine accounts are in multiple groups.
So a trust relationship is not enough to reach the goal. In the ISE you have to add all these groups to the ISE search index in the External Identity Sources - AD settings. Plus you'll have to check for all these groups in the authorization policy (either manually or with a compound condition).
Is that right?