In OnGuard, you can configure Post-Auth Actions . When a device fails compliance, simply telling the user is often not enough. By choosing an action to "Restart the session," ClearPass sends a RADIUS CoA (Change of Authorization) to the switch or controller, which bounces the user's connection. This forces the device to re-authenticate, at which point the new "Unhealthy" status will trigger a restricted or quarantine policy.

The primary benefit of profiling is the transition from "MAC-only" visibility to "Context-aware" visibility. By using multiple collectors (DHCP, SNMP, HTTP, SSH, etc.), ClearPass builds a high-fidelity profile of the endpoint. This allows the administrator to write fine-grained policies-for example, allowing a "Workstation" to access the production server but only allowing an "IoT Camera" to access the NVR. Without this profiling context, the system cannot distinguish between different security levels required for diverse hardware.

Best practice for profiling is to never grant full access by default . Instead, the enforcement policy should include a fallback rule for unprofiled devices. This rule assigns a "Limited Access" or "Quarantine" role that allows only DHCP and HTTP traffic. This allows the device to communicate just enough to trigger the profiler collectors (like DHCP fingerprinting), after which the device can be re-authenticated with the correct role.

The Pre-Authentication Check is a feature of the ClearPass Guest web page logic. It is configured within the Web Login editor under the Login Form settings. This feature allows ClearPass to verify the user's credentials locally or against an external source before the user's browser is redirected back to the controller to finish the process, ensuring that only valid attempts reach the network device.

The domain join will fail because Active Directory enforces a maximum allowable clock skew of five minutes between systems for Kerberos authentication. Since the ClearPass server is 10 minutes behind, the Kerberos ticket validation will fail, preventing the join operation.