Basically, I don't want certain OSs on the network.
Use 802.1x on the switchport-level with client certificates and a credential challenge. This will make it so that only authorized computers and authorized uses have access to the network. Things like Cisco ISE/NAC extend this to allow other checks as well (like current AV definitions and Windows patches), but you can usually configure vanilla 802.1x auth on any managed switch that's worthwhile.
|show 1 more comment|