A security administrator is concerned about employees connecting their personal devices to the company network. Doing so is against company policy. The network does not have a NAC solution. The…

Recursive DNS logs capture domain query traffic but do not provide a real-time inventory of all connected devices or a reliable way to distinguish corporate from personal device identities.

DHCP logs record historical hostname-to-IP lease assignments and may not reflect devices currently on the network, nor do they capture personal devices that use manually configured static IPs.

Active Directory authentication logs only contain records for domain-joined corporate devices; personal devices typically do not authenticate against AD and would be entirely invisible in those logs.

RADIUS logs require an existing 802.1x and RADIUS infrastructure for network access control, which the question explicitly states the organization does not have.

Switch and router ARP tables maintain a live map of every IP-to-MAC binding for all connected hosts, including personal devices that never authenticate against Active Directory or any other corporate service. Because corporate devices follow a serial-number naming convention that is resolvable through DNS or DHCP, the script can compare ARP entries against known corporate device names and immediately identify non-conforming devices. This current-state visibility is essential for a script that must actively disconnect unauthorized devices in real time.