Our organization has been using Cisco ISE for network access control and are encountering a situation that we are struggling determine the next and/or proper approach. I'll summarize in point form...
- Our laptop fleet is co-managed (Config Manager and Intune) and hybrid AD joined (On prem / EntraID)
- ISE has been configured for network access control on our workstations using Computer authentication and PEAP-MSCHAPV2
- We are transitioning our fleet to Windows 11 23H2 and leaving credential guard enabled, thus can no longer use the above
- A second identity source for certificate authentication was configured
- Check AD identity store for cert attribute Subject - Common Name, Always perform binary compare
- Supplicant configuration is deployed via either GPO to Win10 or Intune for Win11
- Win 11 - Use the computer certificate with simple cert selection
- Computer certs managed two ways
- On prem CA issuing auto enroll PKCS certificates published to AD
- Intune configuration for obtaining SCEP cert from same CA
- Certificates have identical information such as CA, CN and Intended purposes
- We are not yet leveraging the Intune / ISE integration but are considering this
The issue here occurs as there are two device certificates the PKCS and the SCEP, one published to AD and one not. The computer will present the certificate with the newest creation date, if the SCEP cert is sent then it is not found in AD as it is not published there (and Binary compare is on)
We are trying to determine how to best proceed with this and what is the most correct / industry standard approach here.
- Reviewing publishing SCEP cert to AD didn't work and was advised this shouldn't be done
- Reviewing turning off Binary Compare had concerns of lesser security
- There doesn't appear to be any supplicant configuration to determine a specific certificate to be sent
- As they come from the same CA and have the same purposes, we cant narrow it down **rther
