Pre-Logon for Company Devices Only

[SSITEdward]

Happy Saturday All!

Here is my scenario:

• We have employee and vendor GlobalProtect connections
• Employees need to Pre-Logon and Always on with a locked-down Client based on AD Group
• Vendors do not need to Pre-Logon and then can have an On-Demand connection with NO locked-down Client based on AD Group

Current Configuration

     Portal:

• Pre-Logon: machine cert installed on endpoint
• Non-Employees: based on AD Security Group GP Client is set to On-Demand and is Not Locked Down
• Employees: based on AD Security Group GP Client is Set to Always-On and is Locked Down

The Non-Empoyee and Employee configs work just fine but I have tried to limit the Pre-logon to device with a certain Reg Key but can't get it to work. Is this possibel and/or has anyone done this before?

Thanks

Ed