topic Re: Changing password of TACACS AD user in the switch CLI in Network Access Control

Changing password of TACACS AD user in the switch CLI

rezaalikhani — Fri, 02 Jun 2023 05:11:40 GMT

Hi all;

I am using ISE 3.2 with Patch 2 in my environment. I am using Device Administration module and configured my Catalyst switches to use ISE as the central point for authentication. When the AD user tries to change its password, sees the following error message:

The following checks and steps I used for resolving this issue:

The AD user configured with the "User cannot changed password" option DISABLED.
The AD join point works as expected.
I choose the new password based on the password policy that is configured on the domain.
The "Enable Password Change" option is enabled under the Advanced Settings for my AD join point.
I have installed the latest patch (Patch 2) on my ISE.

Any ideas?

Thanks

Re: Changing password of TACACS AD user in the switch CLI

Arne Bier — Sun, 04 Jun 2023 20:18:09 GMT

Have you checked the ISE Admin Password Policy settings?

Administration > System > Admin Access > Authentication > Password Policy

Re: Changing password of TACACS AD user in the switch CLI

rezaalikhani — Mon, 05 Jun 2023 04:27:22 GMT

Thanks for your reply;

For the sake of simplicity, I have disabled password policies on my demo lab.

Re: Changing password of TACACS AD user in the switch CLI

Arne Bier — Mon, 05 Jun 2023 06:03:04 GMT

Yeah sorry - that was the wrong question to ask. ISE doesn't get involved with the password complexity checking.

I guess we should ensure that the following checkbox is enabled:

And as for the password complexity, it seems that AD enforces that. I was able to change my AD password once via a TACACS login to a device. And thereafter it flat out refused me to change it to anything else. I wonder if AD is preventing me from doing that.

Re: Changing password of TACACS AD user in the switch CLI

rezaalikhani — Sat, 10 Jun 2023 08:33:55 GMT

Thanks for your reply;

I will do some test and come with the result soon...

Re: Changing password of TACACS AD user in the switch CLI

driverap — Wed, 08 Nov 2023 18:54:52 GMT

@rezaalikhani Is your AD Microsoft/Windows server?

Re: Changing password of TACACS AD user in the switch CLI

rezaalikhani — Fri, 10 Nov 2023 09:47:17 GMT

@driverap

Yes it is.

Re: Changing password of TACACS AD user in the switch CLI

hslai — Sat, 11 Nov 2023 03:47:54 GMT

@rezaalikhani : I agree with @Arne Bier that AD is the one controls the password policy. See Windows Server Password Policy

Re: Changing password of TACACS AD user in the switch CLI

khizerkhan — Tue, 18 Nov 2025 12:38:44 GMT

@rezaalikhani were you able to find a solution for this ?

Re: Changing password of TACACS AD user in the switch CLI

rezaalikhani — Fri, 21 Nov 2025 10:31:42 GMT

@khizerkhan Ensure that the user can change his/her password.