Cisco ISE - AD & Group Managed Service accounts

[dselfridge]

We're about to deploy Cisco ISE to a customer site and they have asked the question...

"Will ISE work with a Group Managed Service Account?    These are service accounts that have their passwords changed periodically."

Now, I'm assuming that if the password changes and Cisco ISE supports gMSA, then it will 'learn' the new password and won't get cut off from AD?

TIA

Dan

[Jason Kunst · Accepted solution]

The account is used for adding ISE as a computer. Once the computer account is added then it should be fine.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/ise_active_directory_integration/b_ISE_AD_integration_2x.html#reference_F19556CAD5C949B58DF89334E2C6255D

[hslai · Accepted solution]

Like Jason Kunst posted, ISE AD runtime is similar to any Windows PC so that it uses its own computer account in AD to authenticate AD users and retrieve their attributes for authorization.

The places where ISE needs an AD user password stored are:

• LDAP -- use AD as a LDAPv3 ID store
• AD providers in Passive ID -- retrieve Kerberos security events from AD DCs.

These two functions are not currently working with gMSA password change mechanism, so we would need update the passwords manually if such accounts are used.