802.1x and computer GPO

Question

Hi,

We use 802.1x with EAP-MSCHAPv2 / PEAP authentification to authenticate our users with dynamic VLAN assignment. It works perfectly but we have issues with computer GPO.

The problem is very simple : we use this kind of GPO to install apps from msi, vbs or mst files (using startup script). But this GPO are called before the user is authenticated on windows. During this time, the computer has no network connection and can't reach the sysvol or any cifs share. We tried to delayed the GPO but the issue is the same. We have open a paid ticket on the microsoft support, but since more than 2 month, we waiting a solution.

What is the best practice to use computer GPO with 802.1x ? Do you have any solution ?

Jerome