Can you support 802.1x? You would still need some sort of authentication server Radius or Tacacs+. This is the route that we are going with, and then we will be able to issue certificates for each computer that is allowed on the network, and we control when the certificates expire.