Our organization doesn’t allow employees to bring in their personal devices like laptops but some users do not respect the policy. We do not want those devices on our network and thought about MAC address filtering but MAC address spoofing is trivial (we have some devices that must be allowed and their MAC addresses are known to all employees).
What can be done to effectively prevent those devices on the network?