Hello Brian, Profiling policies are global. For a windows computer to be profiled separately as DeptH-Windows10-Workstation, it needs to send its hostname in a particular format or send some form of dhcp class identifier and you have to match that in a profiling condition on ISE. The easiest way I think to differentiate building H and I end-devices is, 1) Create new Network device group aka tag for these NADs under Network Devices List > New Network Device 2) Create a separate authorization policy to match this tag and have it assigned built-in Monitor_Profiled authorization for example, Rule Name = Monitor_Policy Condition = Profiled Identity Group (Windows 10, MAC, Printer etc) Permissions = Monitor_Profiled This way you can tag NADs separately for building H and I and end devices authenticated on those can have a different authorization policy. Once the monitoring period is over, you can change the tag on the NADs and bring them under common authorization policy without making a major change. Hope this helps!! Regards, Amod
... View more
.jpg "VIP Advocate"){kind=icon}
