I'm in the process of finishing up my authorization policy and was hoping to get some input on how to deal with freshly imaged machines. The current authorization policy relies on Active Directory (peap-tls) and CCM (eap-tls). Since the newly imaged machines will not be part of the domain yet they'll fail and will either be completely denied access or they'll be dropped into a null vlan.
Would it be viable to create a policy that says if your name starts with the first 5 characters of our naming convention then you can be dumped onto the internal data VLAN and couple that with a DACL permitting access to ports necessary to join the domain?
I'm not sure what type of security implications this would have?
If this is not a suitable route what would be a best practice approach?