So this question was copied from a post that I posted on Reddit:
(7) Is Cisco ISE NAC and 2FA at Windows Logon possible? : Cisco (reddit.com)
To reply to your question: If possible we wish to apply this to both wired and wireless. To recap - we want to have 2FA at windows logon and then have NAC applied once the user authenticates. We have also moved away from Windows Hello for Business rightly because it stores biometric data locally on the TPM, hence it will never pass the auth details to Cisco ISE. We're trying DUO now, at Windows logon, however, since the user would not have obviously authenticated yet, they would not have any access to the DUO servers on the internet, and they will be prompted with an offline code on every startup. Is there anyway around this? Maybe set the user on an isolated VLAN at logon, with access only to DUO servers..so far we have not managed to find the right solution to what we have in mind.
