Normally when deploying an SSL VPN solution with a cert check, I would deploy an internal MS CA and configure a GPO to give out computer certificates. The username/password with MFA proves the user is who they say they are and the computer certificate validates the computer belongs to the company's domain. Recently had an issue with a vpn client which could not read the local computer store without having local admin and according to company policy, users don't have local admin. The suggested solution was to issue a User certificate instead. Now by default, the template for User certs allows them to be exported, so we made a custom template that does not allow for export.
Every guide you read for distributing internal certs for this kind of setup uses computer certs, but the question is why? Is it really any more or less secure then a user certificate? You can't get a User cert from a non-domain computer, which is the same for Computer certs. Really it seems like it's accomplishing the same goal, with the only big different is that the Computer cert lives in the Local Computer store while the User cert lives in the User's cert store. You need local admin to read the local computer store, but that's not really increasing the security that much since neither Computer or User cert private keys can be exported. If you installed some of the additional Web plugins on the CA you could make it possible to allow non-domain computers to request certs, but those are not enabled.
In the end, you have to be on a domain computer to get a User cert issued to you, so it basically proves it's a company asset. Really woudln't user certs be easier to deal with since they don't have the headache of needing local admin to even read them? I can't think of a difference in terms of security really, but if that's the case then why does every guide suggest Computer certs? Trying to vet this out to see if there is some angle I'm missing, thought it would be helpful to ask a larger community since I've discussed this with many collegues and no one could think of a gotcha or security concern.