We have company-issued laptops that users can log into using smart cards. Using the Tunnel-PVT-Groupd-ID RADIUS element, we can assign the machine to a VLAN based on the authenticated user. However, we only certain machines to be able to be placed on that VLAN when that user logs in.

Is there a way to assign a machine to a VLAN based on both the certificate installed on the machine for machine authentication and the logged in user using NPS?

  • You need to give us more information. What is your network topology, network device model, and network device configurations. Whether or not you can do this is dependent on the information you provide.
    – Ron Maupin
    Commented Jan 26, 2018 at 23:37

1 Answer 1


you’ll want to use EAP chaining by using EAP-FAST which allows you to link the user and machine authentications.


Not the answer you're looking for? Browse other questions tagged or ask your own question.