Hello
I am in the beginning stages of implementing Wired ISE / 802.1x using EAP-TLS. We have user and machine certificates and an internal PKI. For the most part everything is working. The very limited amount of users i put on this is working just fine. Printers, cameras all authenticating with MAB are working, etc.
Now i am at a crossroads and trying to figure out the best course of action. Our Help Desk Team needs to be able to log into user machines with the local Windows Admin Account. This can be for a number of different reasons. But the primary focus is new machines straight out of the box. Help Desk receives a new machine and need to install updates, domain join it, etc. Domain Joining is the primary concern. Once its domain joined, then GPO kicks in and certs, etc are pulled. All other functions they need can be performed after joining such as installing updates, etc.
So if there is a brand new machine that has no user certificates...how do we allow this local admin user access to the network?
And just to make it even more complicated. Once that machine is on the domain - that local admin account's password is now controlled by MS LAPS.
I currently have 2 support tickets with TAC - and none of them have been able to assist as of yet. There has to be another company out there that's faced this issue before. I do understand that we can simply designate a few physical ports that do not use Dot1X...but im not sure our security team will be OK with that.
Any help or ideas would be appreciated. Thanks.
