What is the best practice to check if MacOS device is Domain Joined or not?

[Nate Zhang]

In one of the deployment, we need to check MacOS is Domain Joined or not so that we can apply ISE posture check to that device.

If this is a Non-Domain Joined device (like BYOD) device, we would apply it to go through BYOD flow.

Authentication is using EAP-PEAP.

[Francesco Molino]

Hi

If mac devices are joined to a Microsoft AD domain, it means the object ad will be a member, at least of domain computers.

If you create a rule that use this group, the result will show if the device is member or not of your AD.

[Nate Zhang]

Hi Francesco,

Thank you for the information. Yes, the Mac devices are Domain Joined.
Could you elaborate more about the rule? How should it be configured and which condition to be used?

[ldanny · Accepted solution]

You can use the AD attribute - "AD-Host-Exists = True" as a condition.

 

[Francesco Molino]

Sorry for my late answer I was at Cisco Live but you got the answer. Sorry