topic Re: 24407 User authentication against Active Directory failed in Network Access Control

24407 User authentication against Active Directory failed

Arwa Albasari — Mon, 02 Dec 2024 08:43:55 GMT

Hello,

I am implementing ISE 3.2, and facing an issue where users are unable to change their expired passwords. I receive the following error message:
24407 User authentication against Active Directory failed since user is required to change his password
I have already ensured that the "allowed protocols" configuration permits password changes. However, the problem persists. Has anyone faced a similar issue or can suggest a potential solution?

Re: 24407 User authentication against Active Directory failed

Mark Elsen — Mon, 02 Dec 2024 10:20:49 GMT

- Can you also check if the "Enable Password Change" option is set in the Active Directory settings"
Administration > Identity Management > External Identity Stores > Active Directory > Advanced Settings.

Re: 24407 User authentication against Active Directory failed

Arwa Albasari — Mon, 02 Dec 2024 10:40:37 GMT

Yes, the "Enable Password Change" option is enabled, but the issue persists.

Re: 24407 User authentication against Active Directory failed

ahollifield — Mon, 02 Dec 2024 13:00:52 GMT

Why are you using PEAP/MSCHAPv2 in 2024? MS-CHAPv2 uses broken MD4 encryption. You should move to TEAP using user and device certificates instead.

Re: 24407 User authentication against Active Directory failed

Arwa Albasari — Wed, 04 Dec 2024 12:11:21 GMT

If I use it, does it solve the problem?