Fast user swithing supported by ISE-PIC /ISE ?

[Uggen]

Hi,

I would like to know does ISE-PIC supports fast user switching . We know that AnyConnect does not but is it same for ISE/ISE-PIC?

[Arne Bier]

To my knowledge there is no network event when a Windows fast user switch occurs. This means that the outside world (RADIUS servers) don’t know that this event has taken place. 
It’s probably best to rely on Machine authentication if you’re using a Windows supplicant. If you’re using AnyConnect then you can combine Machine and User auth. But that won’t solve the fast user switch issue

[Damien Miller · Accepted solution]

I suspect that the endpoint would end up with the permissions based on the last user that completed a new log in.

When user B logs in, a new login event would be generated in AD that PIC would read. PIC's not context aware that more than one user would still be logged in. This is because ISE PIC is just monitoring AD login events and nothing but a fresh log in has occurred.

A new log on event doesn't get, created in AD when user A "logs" back in to an existing session taking it from hypothetical user B. User A would have the network permissions of user B upon resuming.

The only way to force the correct flow is to disable fast user switching via gpo, or installing NAM which disables it locally.

[Jason Kunst]

Not sure what PIC has to do here but it doesn’t have anything to do with dot1x or supplicants