topic Re: Machine Authentication vs Posture Assesment in Network Access Control

Machine Authentication vs Posture Assesment

henokk60 — Mon, 15 Sep 2025 07:25:07 GMT

Hi All,

I have been looking into the exact difference between machine authentication and posture assessment. If I perform a posture assessment on a machine before it joins the network—such as checking whether it is a corporate device, AD domain-joined, or passes other health checks—what is the benefit of also having machine authentication?

Thanks

Re: Machine Authentication vs Posture Assesment

Rob Ingram — Mon, 15 Sep 2025 07:34:26 GMT

@henokk60 machine authentication, checks the machine credentials (AD computer account or certificate) is valid. Posture assessment checks the computer is compliant with posture policy, i.e., is Anti-Virus/Malware installed and up to date or are Windows patches installed or registry checks etc. Posture assessment is run for logged in users, not during machine authentication.

The benefit of running machine authentication is machine group policies can be applied or any pre-user login tasks.

Using TEAP (machine and user authentication) is now good enough to confirm a corporate device without necessarily running posture assessment.

Re: Machine Authentication vs Posture Assesment

MHM Cisco World — Mon, 15 Sep 2025 07:59:50 GMT

Answer for your Q

AD join as posture compliant is not available as I know.

So only way to check machine with AD is use machine authc.

MHM

Re: Machine Authentication vs Posture Assesment

henokk60 — Mon, 15 Sep 2025 09:25:41 GMT

@MHM Cisco World Yes you can do that by using the registry condition list to check for specific domain and we already achieve that.

Re: Machine Authentication vs Posture Assesment

Aref Alsouqi — Mon, 15 Sep 2025 10:39:39 GMT

In addition to what @Rob Ingram mentioned, using machine certificate authentication is a secure way to ensure that the machine belongs to your corporate. Although you might run similar checks via posture assessment, however, the big difference between the two that I see is that impersonating or stealing the machine certificate is less likely to happen. On the other side replicating the conditions you have on the posture assessment checks could potentially be something easy to achieve.

Re: Machine Authentication vs Posture Assesment

MHM Cisco World — Mon, 15 Sep 2025 10:41:28 GMT

MHM