topic Re: ISE AD-Host-Exists Profiling in Network Access Control

ISE AD-Host-Exists Profiling

Alex Pfeil — Fri, 21 Feb 2020 18:42:40 GMT

I have a profile condition setup so that if the AD-Host-Exists, then add some points and possibly profile a device as a domain device. I have an iphone that does not AD-Host-Exists and it is matching the profile. Running ise 2.3. Any ideas?

Re: ISE AD-Host-Exists Profiling

Ben Walters — Fri, 29 Dec 2017 13:54:41 GMT

Have you checked the profiler report?

Under Operations > Reports > Reports > Endpoints and Users > Profiled Endpoints Summary

If you look at the device details it should give you a bunch of information related to the profiling of the device, start there and you might see something that doesn't look right for your setup.

Hope that helps.

Re: ISE AD-Host-Exists Profiling

mustafa83 — Thu, 13 Jun 2019 00:49:38 GMT

Hi Alex,

This sounds alarming, was this ever resolved? the reason i'm asking because i'm using AD-Host-Exists for corporate windows machine in my dev. environment, but dont have iPhone on it yet.

Thanks,

Mustafa

Re: ISE AD-Host-Exists Profiling

hslai — Thu, 13 Jun 2019 15:21:46 GMT

Profiling Using the Active Directory (AD) Probe shows how this works. If a mobile device has the same hostname as an existing domain computer, then that becomes a false positive. I would recommend to use additional attributes to further differentiate.