Error: Password reset is only possible from STANDALONE or PRIMARY nodes.

[FLEX.Support]

My web "admin" for my ISE deployment has expired. I did some searching and found a way to reset the password via CLI. Through the command line, issued the following command, "application reset-passwd ise admin" I received a prompt for the new password and then the confirmation password prompt. After the confirmation password, I received the following error "Error!  Password reset is only possible from STANDALONE or PRIMARY nodes." Now, we have a pretty simple deployment. It's a standalone deployment of 2.4 done as a virtual appliance. So the error doesn't make complete sense to me. Am I doing something wrong? How do I get the admin back to working status? Any help is much appreciated. 

[ajc]

It does not make sense. Did you try to reboot the VM running ISE Primary PAN using your VMware access and try again?

[Arne Bier]

If Abraham's suggestion doesn't work, then the last resort is to boot that VM from the ISE 2.4 .iso and choose option 4 to reset the admin password (this is the password recovery option used when you're in dire straits)

[ronei.amorim]

I'm facing the same issue...

But the option 4 from recovery image it's only for CLI admin...

Welcome to Cisco Identity Services Engine - ISE 3355

To boot from hard disk press <Enter>

Available boot options:

[1] Cisco Identity Services Engine Installation (Keyboard/Monitor)

[2] Cisco Identity Services Engine Installation (Serial Console)

[3] Reset Administrator Password (Keyboard/Monitor)

[4] Reset Administrator Password (Serial Console)

[ronei.amorim]

I'm trying too...

/admin# application reset-passwd ise admin
Enter new password:
Confirm new password:

Error! Password reset is only possible from STANDALONE or PRIMARY nodes.

The node was deregistered and I need register again, but admin password expire.

I also reboot two times and nothing... I'm thinking reset ise config.
But I dont know if keeps certificates already deployed.

[musultan]

As you said it is DE-registered from current deployment, then i am expecting that it should be displayed as STANDALONE.

can you check in "show tech-support" and verify the Node role as following?

*****************************************
Displaying ISE deployment ...
*****************************************
Node Config Details

NAME            PERSONA        ROLE       ACTIVE      REPLICATION
------------------- --------------- ---------- ---------- ---------------
ISE-1        PAN,PSN        PRIMARY    NONE      Not Applicable
ISE-2        MNT         SECONDARY  STANDBY      SYNC COMPLETED

[ronei.amorim]

That's my output form show tech

*****************************************
Displaying ISE deployment ...
*****************************************
Node Config Details

NAME                PERSONA         ROLE       ACTIVE     REPLICATION
------------------- --------------- ---------- ---------- ---------------
ISE01             PAN,MNT,PSN     PRIMARY    ACTIVE     Not Applicable
ISE02             PAN,MNT,PSN     SECONDARY  STANDBY    SYNC COMPLETED

[Arne Bier]

So did you issue the command

application reset-passwd ise admin

from ISE01?  This is the Active PAN.  If ISE tells you that it's not the ACTIVE PAN then you probably need to ask the TAC.

I suggested booting from .iso to set the ISE CLI admin password (but I misread your original issue) - sorry for that.  If you have the cli admin password for both nodes then no need to perform the password recovery I suggested.

[sachin.tyagi · Accepted solution]

Looks like a bug with ISE version 2.4. I am running with same issue on version 2.4:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj14636/?rfs=iqvred

Workaround: reload the PAN and then application reset-passwd ise command will work.

[mazhar mahadik]

HI ,

Reload option worked for me, i did reload of ise from cli, & then application reset-passwd ise worked,

Thanks,