topic Re: ISE 2.7 and AD Windows 2019 activation authentication level in Network Access Control

ISE 2.7 and AD Windows 2019 activation authentication level

katerina.dardoufa — Fri, 28 Jan 2022 12:13:08 GMT

Hello all,

after upgrading our Active directory environment from Windows 2012 to Windows 2019 and installing the latest security updates from Microsoft (KB5004442), logs on the DC show the following error regarding the connections from ISE.

The server-side authentication level policy does not allow the user domain\user SID (S-1-5-21-9321468-1570001470-2076119496-113405) from address ISE_ip_address to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.

According to Microsoft a temp solution would be to change the registry on the DC. But from June2022 this hardening will be permanent (https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c)

Is there something that can be done on ISE side to fix the problem?

Thank you in advance,

Katerina

Re: ISE 2.7 and AD Windows 2019 activation authentication level

Mark Elsen — Fri, 28 Jan 2022 16:25:46 GMT

- FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvz97194

Re: ISE 2.7 and AD Windows 2019 activation authentication level

Peter Koltl — Fri, 28 Jan 2022 19:07:31 GMT

Is this about ISE-SCCM server integration (external MDM / Desktop Management) ? It’s always been a nightmare to set up the DCOM and registry privileges.

Re: ISE 2.7 and AD Windows 2019 activation authentication level

hslai — Sun, 30 Jan 2022 21:58:15 GMT

It's affecting the Active Directory as a PassiveID provider via WMI.

Re: ISE 2.7 and AD Windows 2019 activation authentication level

lifesouthhd — Tue, 01 Feb 2022 18:06:58 GMT

What if you stopped using ISE-PIC and just use Active Identity instead? We have ISE-PIC tied into our AD environment and using PXGRID services for USER to IP mapping for FMC firewall policies to work correctly. Is there a downside to switching over to active identity? And no longer using passive-id?

Re: ISE 2.7 and AD Windows 2019 activation authentication level

katerina.dardoufa — Wed, 02 Feb 2022 11:58:42 GMT

Hello,

this is an interesting approach... I will have to contact our partner and see what their thoughts are on the matter.

Thank you for the suggestion 🙂