ISE domain PC question

Question

I am trying to figure out how to grant access to users based on user authentication and computer accounts. I am trying to setup our ISE so that if a user on our domain connects to the wifi it will check to see if the PC they connected from is a member of our domain. If the computer is a member of the domain they will get full access to our network. If they are not s member of our domain they will get put into a different vlan than only has Internet access. Ultimately I would like to have a group in active directory for computer accounts that are allowed on the wifi. Is a setup like this possible? I have tried a few things and i can not get the computer account part to work.
Sent from Cisco Technical Support iPhone App

Answer 1

Hi Eric,
We  can create different rules in the authorization policies as per the  your scenarios. For you query we can setup the following rule
step1
: Prior to user enetering theri credentials.....machine will get authorized access when machine  boots up
iselabin.local:ExternalGroups==Domain  Computers
step2
:User will enter credentials and he will get  authorized access because of  2nd Rule.
Network Access:WasMachineAuthenticated ==True
                              AND
iselabin.local:ExternalGroups==Domain Users
Also you need to go through the MAR as you are using Macine+User  authentication.Below is the link for the same in which you can find MAR  section.:
http://www.cisco.com/en/US/partner/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/UsrDb.html#wp354105.