EAP-TLS - Device vs User certificates

[monolog99]

Hi,

I have a Cisco ISE server authenticating our Wi-Fi users via EAP-TLS using the Local Computer / Machine certificate on the users PC. The users PC's also have Current User certificates installed as well.  I'm trying to use the user cert for authentication in order that I can then perform an AD lookup against the CN of that cert, which is the username.  However,  ISE is using the device certificate instead, where the CN of that cert is the PC name.

How do you tell ISE to use the User cert instead of the device/machine cert for EAP-TLS ?

Thanks,
Tim.

[Rob Ingram · Accepted solution]

@monolog99 you need to configure the supplicant on the windows computer to use "User or computer authentication"

Example: https://integratingit.wordpress.com/2019/07/13/configuring-windows-gpo-for-802-1x-authentication/

[monolog99]

Many thanks Rob. Cheers.