topic Marvin, Neno, Many thanks for in Network Access Control

ISE AD integration

Tong Zhang — Mon, 11 Mar 2019 05:15:37 GMT

Hi,

Very often, when we integrate ISE with customer AD and try to join ISE into domains, customer will ask what kind of service account they'll create for us to use to join the domain. Based on Cisco documentation, the service account should allow ISE to read the AD user/machine records, and should also "has sufficient privileges to create and remove machine accounts in the domain, or alter the passwords for previously created machine accounts". Often, the latter part alerts the customer, and we've been pushed back and asked why. Based on the normal use cases, seems ISE only need to read the record rather than create account, what is the reason we need the capability to create the machine account? If the credential not support creating machine account, what's the impact?

Many thanks in advance!

Tina

When you integrate ISE with

Marvin Rhoads — Thu, 11 Dec 2014 00:42:27 GMT

When you integrate ISE with AD, one of the things done by the service account (or other account used) is to join the ISE servers themselves to AD.

Once that is done, you could probably remove that particular privilege from the defined account if it's inconsistent with organizational security policy.

(Note that a 1.3 upgrade requires rejoining the ISE nodes so the privilege would need to be reinstated during the post-upgrade rejoin.)

Hello Tina, Marvin makes a

nspasov — Thu, 11 Dec 2014 06:49:28 GMT

Hello Tina, Marvin makes a very good point that ISE does not require a "Service Account" like ACS does. With ISE, once the deployment is joined to the domain, the AD account is no longer used so it can be disabled or even deleted. In addition, many of my customers don't even use a "service" account to join ISE. Instead, they use their own account or some other network related account.

I hope this helps!

Thank you for rating helpful posts!

Marvin, Neno, Many thanks for

Tong Zhang — Thu, 11 Dec 2014 14:38:43 GMT

Marvin, Neno,

Many thanks for you guys response!

Tina

Tina,You're welcome.Please

Marvin Rhoads — Thu, 11 Dec 2014 14:59:28 GMT

Tina,

You're welcome.

Please take a moment to rate helpful posts.