Machine Authentication vs Posture Assesment

[henokk60]

Hi All,

I have been looking into the exact difference between machine authentication and posture assessment. If I perform a posture assessment on a machine before it joins the network—such as checking whether it is a corporate device, AD domain-joined, or passes other health checks—what is the benefit of also having machine authentication?

Thanks

[Rob Ingram]

@henokk60 machine authentication, checks the machine credentials (AD computer account or certificate) is valid. Posture assessment checks the computer is compliant with posture policy, i.e., is Anti-Virus/Malware installed and up to date or are Windows patches installed or registry checks etc. Posture assessment is run for logged in users, not during machine authentication.

The benefit of running machine authentication is machine group policies can be applied or any pre-user login tasks.

Using TEAP (machine and user authentication) is now good enough to confirm a corporate device without necessarily running posture assessment.

[MHM Cisco World]

Answer for your Q

AD join as posture compliant is not available as I know.

So only way to check machine with AD is use machine authc.

MHM

[henokk60]

@MHM Cisco World Yes you can do that by using the registry condition list to check for specific domain and we already achieve that.

[MHM Cisco World]

Register not meaning that device connect AD to check if it valid or not

MHM

[Aref Alsouqi]

In addition to what @Rob Ingram mentioned, using machine certificate authentication is a secure way to ensure that the machine belongs to your corporate. Although you might run similar checks via posture assessment, however, the big difference between the two that I see is that impersonating or stealing the machine certificate is less likely to happen. On the other side replicating the conditions you have on the posture assessment checks could potentially be something easy to achieve.