Check if Computer Account in Active Directory is enabled/disabled

[d0zer4489]

Hello Community,

i want to know, if its possible to check with Cisco ISE if a ccmputer account in active directory is set enabled/disabled.

We got an authorization aolicy working and want to add a check, that just enabled computer accounts in the active directory get access. Disabled Accounts should be rejected.

Do you got some ideas how i could handle this?

I found nothing in the Microsoft Dictionary provided on the ISE.

I hope you can help me, thank you.

Best Regards

[jrabinow]

There is an attribute in the Active Directory dictionary called IdentityAccessRestricted. Is a boolean and will be set to true when access for user is restricted. Needs to be leveraged in authorization policy