A network engineer joins Cisco ISE to Active Directory and wants to ensure that only corporate laptops that have first authenticated the machine account to the domain can subsequently pass user 802.1X authentication. The company will NOT deploy EAP chaining or TEAP due to legacy supplicant limitations. Which ISE Active Directory feature should the engineer enable to enforce this requirement?