topic Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2 in Network Access Control

Cannot connect to AD from Identity Mapping - Windows 2012 R2

nir-r — Thu, 26 Jan 2017 19:40:27 GMT

Getting the error below when using PassiveID and trying to add Windows 2012R2 DC:

"The connection was tested on 'isemain.cyber.lab' PassiveID active node.

Connection to 'maindc' failed.

Unable to connect to the machine, please check the DC state"

Test user is member of domain admins group, it seems that it failed to run WMI commands.

PassiveID log file:

2017-01-26 20:19:35,197 INFO [qtp1343441044-10 - /][] com.cisco.cpm.cda- Ident

ity mapping service applied configuration. Identity Mapping.number-of-domain-con

trollers = 1 , Identity Mapping.server = isemain ,

2017-01-26 20:19:36,838 ERROR [Thread-18][] com.cisco.cpm.cda- Cannot get Domai

n Controller NetBIOS. Identity Mapping.wmi-class = Win32_NTDomain , Identity Map

ping.exception-message = Access is denied, please check whether the [domain-user

name-password] are correct , Identity Mapping.dc-domainname = test.lab , Identi

ty Mapping.dc-name = maindc , Identity Mapping.dc-host = maindc.test.lab/192.16

8.103.105 , Identity Mapping.server = isemain , Identity Mapping.wmi-property =

DomainName ,

ISE version is 2.1 with patch 2

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

Charlie Moreton — Thu, 26 Jan 2017 20:23:30 GMT

Have you configured the Domain Controller to allow for this? Check out this section on Easy Connect in the ISE Admin Guide:

http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/admin_guide/b_ise_admin_guide_21/b_ise_admin_guide_20_chapter_01101.html#task_3580FB80B8394E078393C71E4AA1233B

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

nir-r — Thu, 26 Jan 2017 21:08:22 GMT

Hi Charles,

Thanks for your help.

It is working for me until I moved to Windows 2012R2, I used your link and it solved the problem.

I just add "Domain Admins" permission (full control) to below registry keys which related to WMI permissions:

HKEY_CLASSES_ROOT\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

HKLM\Software\Classes\Wow6432Node\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}

Thanks,

Nir

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

Charlie Moreton — Thu, 26 Jan 2017 21:12:25 GMT

Great! I'm glad this helped.

Thanks for posting the exact fix.

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

dmooregfb — Fri, 31 Mar 2017 12:04:04 GMT

Nir, working with the same issue during my ISE version 2.2 buildout. Our network admins are asking exactly what do these registry key have to do with the logs. We are also running 2012R2 domain controllers.

Do you know?

Thanks,

Dave

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

hslai — Sun, 02 Apr 2017 08:39:37 GMT

Enabling DCOM for Windows 7, 8 and Server 2012 might help.

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

dmooregfb — Mon, 03 Apr 2017 10:59:43 GMT

hslai, thanks for the link. This is very helpful.

Dave

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

InTheJuniverse — Wed, 12 May 2021 18:12:43 GMT

is there a way to setup email alerting for this event in ISE 2.4

Work Centres > Passive ID > Reports > Passive ID

Severity : Error

Provider Type: WMI

Domain : xyz

Event: Cannot get Domain Controller NetBIOS

Re: Cannot connect to AD from Identity Mapping - Windows 2012 R2

Greg Gibbs — Wed, 12 May 2021 23:43:56 GMT

Duplicate question answered in the following post:

https://community.cisco.com/t5/network-access-control/passive-id-provider-down-alerting/m-p/4402128