LDAP query for machine account?

To answer your question, you would place a registry check with the parameters that you would like to have and branch out into a true/false flow.

Example: * User hits your APM/Firepass * Registry check is in the pre-logon sequence * Branch out as true will equal login (bad security but whatever) * Branch out to a false and provide an access denied or different login screen with other resources available to the end user.