topic Re: What is the best practice to check if MacOS device is Domain Joined or not? in Network Access Control

What is the best practice to check if MacOS device is Domain Joined or not?

Nate Zhang — Thu, 13 Jun 2019 06:42:34 GMT

In one of the deployment, we need to check MacOS is Domain Joined or not so that we can apply ISE posture check to that device.

If this is a Non-Domain Joined device (like BYOD) device, we would apply it to go through BYOD flow.

Authentication is using EAP-PEAP.

Re: What is the best practice to check if MacOS device is Domain Joined or not?

Francesco Molino — Thu, 13 Jun 2019 06:55:20 GMT

Hi

If mac devices are joined to a Microsoft AD domain, it means the object ad will be a member, at least of domain computers.

If you create a rule that use this group, the result will show if the device is member or not of your AD.

Re: What is the best practice to check if MacOS device is Domain Joined or not?

Nate Zhang — Thu, 13 Jun 2019 07:13:24 GMT

Hi Francesco,

Thank you for the information. Yes, the Mac devices are Domain Joined.
Could you elaborate more about the rule? How should it be configured and which condition to be used?

Re: What is the best practice to check if MacOS device is Domain Joined or not?

ldanny — Thu, 13 Jun 2019 11:15:47 GMT

You can use the AD attribute - "AD-Host-Exists = True" as a condition.

Re: What is the best practice to check if MacOS device is Domain Joined or not?

Francesco Molino — Sat, 15 Jun 2019 23:04:13 GMT

Sorry for my late answer I was at Cisco Live but you got the answer. Sorry