Limit authentication to know computers

[it_ib]

Hi there!
OpenVPN works very well for our employees.
We have configured LDAP-Auth against Active Directory.
But I came across the problem, that I can't control if the employees install the client on the personal home computer that is maybe infected with malware.
Can anyone point out, what I could do and how?
Is there a way to check the local computer certificate that every computer in Active Directory has installed maybe?
We did a similar thing to authenticate our WiFi, but when using the same settings for the PFsense with Radius authentication this doesn't work.
Greets,
Dominik