topic Re: Discover/Recover ISE-AD join credentials in Network Access Control

Discover/Recover ISE-AD join credentials

mattw — Mon, 08 Nov 2021 07:41:02 GMT

Hi,

I'll be doing an ISE upgrade for a client soon and we want to make sure we have the AD user account credentials to hand so we can rejoin ISE to AD if we need to after the upgrade.

The client is not sure what account was used when it was set up.

I'm assuming ISE uses that account each time it does a user or group lookup right?

Is there any way to find this out from a log or something what account is being used?

Thanks,

Matt.

Re: Discover/Recover ISE-AD join credentials

Rob Ingram — Mon, 08 Nov 2021 11:04:31 GMT

@mattw Actually no, the credentials that are used for the join or leave operation are not stored in Cisco ISE. Only the Cisco ISE machine account credentials are stored. It's this ISE machine account thats created in AD that is used to communicate between ISE and AD.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html

Re: Discover/Recover ISE-AD join credentials

mattw — Mon, 08 Nov 2021 10:50:47 GMT

Thank you @Rob Ingram.