You're right... there was a question 😛 I was thinking a lot about this possible problem. And so far I did not find a point that this configuration is less secure than using an authentication profile. You only have to make sure that the pre-logon user only has very limited access to the ressources needed at login time (AD, SCCM, Antivirus updates, ...). If you have a specific group where you put all your vpn users into it: You can improve this, at least a little, when you only give this vpn usergroup full internal access and after this rule create a deny all rule. This way if someone has a company computer (or at least a certificate from your PKI) and valid credentials (of someone not belonging to this vpn usergroup) ALL traffic will be blocked. But in this, kind of worst case, situation you have the same problem when you use the traditional authentication profile method. In such situations there are internal processes needed that when a user got his computer stolen, he needs to call your support department as soon as possible to start the processes for revoking the computercertificate and for resetting the user password.
... View more
