Hi Colin thanks for the reply.
The issue is its the same device its not a person registring his friends devices with his username.
What is happening on a endpoint level is that every day the device connects it uses a different mac address.
Even if it was a guy connecting his friends devices with his username what is the chances all his friends have the exact same device and the same first two octets in teh mac address starting with "ce:b0", also why would all his friends devices be "unkown" and no fingerprint?
Seems strange to me and this is seen more and more everyday.
Any idea?
Thanks again for the help.