802.1x wireless security question

Hello, I need some help with wireless security...

I am trying to design a strong security model for my company.

Proposed Wireless Network: WPA2 - AES encryption PEAP using MS-CHAP-V2 (no certs, except on IAS server)

802.1x authentication via a Windows Server 2003 IAS (against the AD) Using Cisco 4402 wireless switches

Within IAS, I have created a policy that authenticates users and computers based on this phrase:

NAS-Port-Type matches "Wireless - Other OR Wireless - IEEE 802.11" AND Windows-Groups matches "domain\\Domain Users;domain\\Domain Computers"

Looking at the IAS log, the policy correctly rejects or denies Machines and Users whether they are a part of these groups or not. I'm hoping to authenticate the machine at boot up (which is working fine) but also authenticate the username AND machine name when the user logs in.

With these current settings, if a user logs in to any PC (even one from home) they fail the machine authentication but if they use their correct domain username and password, they are allowed on the wireless network. Ideally, I would like to see the IAS server check the username and machine at the same time during user authentication preventing this issue.

Can this be done???