topic Re: Passive ID and Read-Only DCs in Network Access Control

Passive ID and Read-Only DCs

paul — Mon, 23 Sep 2019 18:52:28 GMT

I am sure this is documented somewhere, but I can't find it. Does passive ID support RO DCs? When I bring up the DC list in ISE I don't see any of my customer's RO DCs. The SourceFire user agent support RO DC monitoring and we are trying to replace that agent with ISE passive ID.

Re: Passive ID and Read-Only DCs

hslai — Thu, 26 Sep 2019 06:11:15 GMT

CSCvr32010 is a known issue on this area.

Re: Passive ID and Read-Only DCs

paul — Thu, 26 Sep 2019 11:52:53 GMT

Hsing,

That bug is not public. Can you send it over to me?

Re: Passive ID and Read-Only DCs

hslai — Sun, 29 Sep 2019 16:20:48 GMT

The bug has been marked customer-visible since Sept-19 so not sure why you are unable to see it.

It's an enhancement request to add Passive ID support for RODCs and the current workaround is using Windows Event Forwarding (WEF) or a syslog forwarder.

Re: Passive ID and Read-Only DCs

omar.mardini1 — Thu, 05 Nov 2020 15:04:33 GMT

Any update for this issue pls

Re: Passive ID and Read-Only DCs

Greg Gibbs — Fri, 06 Nov 2020 01:32:55 GMT

There are no updates to that enhancement request, so this enhancement does not appear to be implemented in any current versions of ISE. The workarounds mentioned earlier in the thread are still available.

ISE 3.0, however, does support Passive ID using MS-Eventing API or Microsoft Remote Procedure Call (MSRPC) protocol as per the Release Notes. You might test if that works with your RODCs instead.

Re: Passive ID and Read-Only DCs

medgaz — Mon, 10 Jul 2023 14:18:37 GMT

Hello, I am having the same issue, I have configured RODC to send security events to DCs, but MSRPC agent is not reading those users? Do you know why?