How to deregister a secondary node from a Cisco ISE cluster using CLI

[behzad bayat]

I have a Cisco ISE cluster. The primary node is no longer available, and I cannot access the GUI for the secondary node. However, I have access to the CLI for the secondary node. How can I change the password policy for the secondary node? I've attempted this, but it didn't allow me to proceed and instead prompted me to do this via the primary node, which is no longer available.

Additionally, how can I deregister the secondary node from the cluster using the CLI without erasing licenses?

TNX

[agrissimanis · Accepted solution]

When you say you can't access the GUI of the secondary node, do you mean you can reach the GUI, but you just don't know the local admin password and need to change it?
If yes then then reset the GUI password on the secondary node from CLI using:
application reset-passwd ise admin
Then, when you get access to the GUI of the secondary node, you can promote it to the primary from there. That way you will maintain the licences, config and everything else from the primary.

There isn't a way to do this from CLI and you also can't deregister your secondary from the CLI while maintaining the configs and licences.

From CLI you can issue "application reset-config ise", this will deregister the node and will make the node standalone again, but you will also lose all the configs.