topic Question on ISE machine account on Active Directory in Network Access Control

Question on ISE machine account on Active Directory

smukai — Tue, 24 May 2016 10:43:02 GMT

I have a question on the ISE machine account that needs to be created on Active Directory: Why does it want ability to change its own password?

http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/ISE-ADIntegrationDoc/b_ISE-ADIntegration.html#reference_F19556CAD5C949B58DF89334E2C6255D

> Active Directory Account Permissions Required for Performing Various Operations

> Cisco ISE Machine Accounts

> * Ability to change own password

Thank you!

Re: Question on ISE machine account on Active Directory

howon — Tue, 24 May 2016 11:04:12 GMT

It is MS requirement. All machines joined to the domain are required to change its password periodically. I believe the default interval is per 90 days. Many think that the password is set by the AD server, but that is not the case, the password is generated from the machine and updated to the AD server which is why that permission is needed.

Re: Question on ISE machine account on Active Directory

smukai — Tue, 24 May 2016 11:15:24 GMT

I believe this answers my question. Thank you very much!