[Solved] NPS VLAN assignment only when BOTH certificate & computer group membership

Question

I am doing something that is definitely not supported.
Allowing AAD ONLY joined devices (Intune managed) to connect to internal WiFi using local CA issued certificates

It is described here: https://social.technet.microsoft.com/Forums/lync/en-US/7c6dcb5c-7e24-4a10-89d0-3f8fcec55877/ndes-scep-certificate-to-connect-to-enterprise-wifi-nps-radius?forum=microsoftintuneprod

So machines that know nothing about local AD, do get 802.1x authenticated to WiFi by Windows Server NPS.

That works (almost) as much as I need it to.

But I want to assigned machines/users to different VLANs, based on group membership

So the question I had: https://social.technet.microsoft.com/Forums/lync/en-US/b8383316-d3fa-4f87-833a-889d5387b775/nps-vlan-only-when-both-certificate-amp-computer-group-membership?forum=winserverNAP

Can I combine 2 conditions: certificate existence AND machine group membership?

Thanks

Seb

Answer 1

Works perfectly fine!

"Computer ONLY authentication (no user involved)" & "machine has CA certificate" DOES work in Server 2012 R2 NPS

And machines are not even AD joined (they are only AAD joined & managed by Intune with dummy AD Computer objects)

Answer 2

Hi,

Thank you for posting in Q&A!

In regards to your issue, this is a similar case also want "NPS assigned machines/users to different VLANs, based on group membership".
nps-assign-vlans-based-on-users-groups-8021x-wired
He has opened a case with micorsoft support and find out the following conclusion:

"with NPS it is not possible to do an automatic re-authentication based on the user if the computer is already authenticated. For the re-authentication the NIC needs to be brought down and up again and that is only possible if you make a task scheduled item for this or to script this at user logon."

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Above is not really what I want

I need NPS to drop the machine to correct VLAN only if BOTH are fulfilled for Computer ONLY authentication (no user involved)

• machine has CA certificate
  AND
• machine is in a specific AD Computer group

If machine has ONLY certificate but no group membership, it gets dropped to a different VLAN

Answer 4

@Sebastian Cerazy Hi，

Sorry for the late reply!

Based on my research and discussion with my colleagues, as stated in the microsoft offical document,
nps-np-configure

"you can configure network policy to instruct the access servers to place members of specific Active Directory groups on specific VLANs."

(1) So the "machine is in a specific AD Computer group" can be achieved,
(2) however, unfortunately "Computer ONLY authentication (no user involved)"&"machine has CA certificate" can not be achieved in microsoft NPS server.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.