Microsoft NPS force computer and user auth

[KOVID]

I have set up Cisco WLAN using 802.1X with Microsoft NPS and it is capable of authenticating user against security groups on AD. In my case i am having 2 different network policies, one for computer where as the other one for user. My problem is that policy works sequentially as an OR statement instead of AND statement. Due to this mess users can logon from an invalid computer as well. I just want user on domain computer in security group to logon and not any invalid computer. what are my options for the same???

[BiGMaCHiNe]

Buy enabling the nap you get an option to work with users and also with the groups in machine with same policy. There is some limitations to work with the two options. I had found some kind of security popups which troubles the users in that. Those only work successfully when the policies in that are split and implemented effectively. In this when the same is enabled the users are authenticated by 802.1x and then transmit an computer identity in the NAP SoH.