topic Re: ISE Windows account?? in Network Access Control

ISE Windows account??

Michael Bartholomæussen — Sun, 16 Feb 2020 12:03:23 GMT

I've inherited an ISE deployment and In our AD there is a ISE service account who is a domain admin.

Going through the ISE guides, I can that the service account need specific permission in AD, and I guess they've used a domain admin (the dirty way).

I want to rectify this by creating a new account with the specific permission, but I can't seem to find where the account is defined within ISE. The only account I can find (but not used in any way), is the AD join account.

So the question is, where do I find the other account in ISE?

Re: ISE Windows account??

Damien Miller — Sun, 16 Feb 2020 16:08:15 GMT

If this account was created to only join ISE to AD, then you don't need it anymore. When you join ISE to AD, the service account is only used to create a machine object within AD. From that point on, ISE leverages the AD computer object to perform lookups.

You should be able to find a computer object per ISE node that has been joined in the directory.

Re: ISE Windows account??

Michael Bartholomæussen — Mon, 17 Feb 2020 12:47:56 GMT

Hi Damien

Both nodes are present in AD, and "joined" under External Ident.

I've stepped through the guide again, and under "Set Permissions for Access to WMI Root/CIMv2 Name Space" the account is applied on our Domain controller. But I can't seem to find, where the user is defined in ISE (where the pwd is set)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_01110.html#task_784A7F6991594B11B1BAD206FDCD249B

Re: ISE Windows account??

Damien Miller — Mon, 17 Feb 2020 15:15:10 GMT

When you join ISE to AD, the user name and password will be typed in to the GUI, but it is single use only. It's not saved after the join operation is completed on a node.

The user account you use to join ISE to AD is not used by ISE after the join is complete. The computer objects created while joining are what ISE leverages past the join operation.

Re: ISE Windows account??

hslai — Fri, 21 Feb 2020 04:36:07 GMT

The WMI thing is for Passive Identity.

Unless you are using that feature, you would not need the user credentials, just like Damien said.

Re: ISE Windows account??

Damien Miller — Fri, 21 Feb 2020 21:16:46 GMT

Passive identity is a good exception to note. I was thinking of this from strictly a node being joined to AD.

Re: ISE Windows account??

Michael Bartholomæussen — Tue, 25 Feb 2020 07:54:33 GMT

I haven't found the settings for the service account within ISE?

Re: ISE Windows account??

Michael Bartholomæussen — Tue, 25 Feb 2020 08:56:39 GMT

Editing the settings for the PassiveID Domain Controllers, the option is there to set the password for the service account. I had only been focusing on "Config WMI" and "Add Domain Controllers"