How to securing endpoints?

[WALI <hkhasgiwale () gmail com>]

Seeking pointers on how to secure endpoints within the LAN.

With an AD domain running, without any Radius authentication mechanism, I 
am wondering whether it would be worth investing yet, in the nascent 
Microsoft/CISCO NAC technology.

My main concern is, to find ways to prohibit anyone/everyone to be able to 
just plugin their PC/laptop into the UTP wall socket and get a lease from 
my DHCP servers. We are looking at a network of about 1000 pc's here.

MAC learning and locking at the switch layer is an option but I foresee a 
huge administrative overhead in my scenerio where helpdesk rolls out 
several new PC's daily.

Any other options??