ISE Lock accounts to machines

Question

I am trying to determine if there is a way to limit the number of logins. Basically, the requirement is to allow a user X number of concurrent logins, but restrict those logins to the first X machines they log into.  The requirement is to prevent users from passing their credentials around to other unauthorized users.

Answer 1

Michael,
You can only restrict guests to one concurrent login of 1 or unlimited. However if you have a list of all mac addresses, you can import them into ise and statically assign them to a endpoint group, from there you can combine a policy that only allows users to connect with a device that you assigned to an endpoint group with a valid AD account.
However your best bet is to deploy certificates if you run in an AD environment where all devices are joined to the domain, it is very simple to use group policies to deploy certificates which you can make the private keys not exportable. Then you can switch your authentication policy so that certs are used instead of passwords.
Let me know if you run all users in AD or if you would like some info on certificate enrollment
Tarik Admani
*Please rate helpful posts*