Managing admission of unrecognized devices onto an enterprise network

A computer program product encoded on one or more non-transitory computer storage media, the computer program product comprising instructions that, when executed by one or more computing devices, cause the one or more computing devices to perform operations comprising:

• detecting a device on an enterprise network;
• when the device provides, to a threat management facility, a heartbeat from a local security agent executing on the device that identifies the device as one of a set of managed devices for the enterprise network, permitting the device to communicate over the enterprise network;
• and
• when the device does not provide the heartbeat to the threat management facility, identifying a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of the local security agent to the device, directing the device to a landing page of a portal configured to manage admission of unrecognized devices onto the enterprise network by interactively guiding a user of the device through a network entry procedure in the user interface and delivering device management capability to the device by delivering the local security agent that provides the heartbeat to the device for installation on the device.

A system comprising:

• a portal for managing admission of unrecognized devices onto an enterprise network, the portal including a first memory and a first processor, the first memory having stored thereon computer executable instructions for causing the first processor to deliver device management capability to a device on the enterprise network;
• and
• a threat management facility associated with the enterprise network and in communication with the portal, the threat management facility including a second memory and a second processor, the second memory having stored thereon computer executable instructions for causing the second processor to identify the device as one of a set of managed devices for the enterprise network, to permit the device to communicate over the enterprise network when the device is one of the set of managed devices, and, when the device is not one of the set of managed devices, to identify a type of the device from among two or more device types, and upon determining that the type includes a user interface and that the type is manageable by the threat management facility by delivery of a local security agent to the device, to direct the device to a landing page of the portal and to cause the portal to interactively guide a user of the device through a network entry procedure using the user interface and to deliver the device management capability to the device by delivering the local security agent that provides a heartbeat to the device for installation on the device.