ISE account password update failed

[Srinivasan Nagarajan]

Hi Experts,

We're running ISE version 2.6 Patch 7 installed. On SAN, we noticed, it's left the AD and in the Report->Diagnostics,  it showing as ISE account password update failed.

As per the below URL, ISE machine account has set the privileges to renew its password. How many days once ISE will update its password..? And, what to check next...? Thanks in advance

https://www.cisco.com/c/en/us/td/docs/security/ise/1-3/ISE-ADIntegrationDoc/b_ISE-ADIntegration.html#reference_F19556CAD5C949B58DF89334E2C6255D

[Colby LeMaire]

How often the machine account passwords change is a function of Active Directory.  By default since Windows 2000, the setting is 30 days but can be modified.  That means that every 30 days, the computer will attempt to change its password with Active Directory.  More information on this can be found here:

https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age

It sounds like a permissions issue.  If your ISE node is no longer joined to the domain, try to join it again.  If it joins but then hits the same error again in 30 days, then there is some setting or issue preventing the ISE machine from changing its password.  One example of a setting to refuse password changes for machines is here:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj852280(v=ws.11)

In Active Directory, locate both of your ISE admin node computer objects and open properties on each.  Make sure they are both members of the same security groups.  Other than that, you would need to look at the Event Viewer logs on the domain controller that the ISE node was attempting to communicate with.

[Srinivasan Nagarajan]

Hi Colby,

Thanks for the reply.

What if we delete the existing machine account on AD and when ISE joins the AD, hope new account will be created (again) and there we can set the permissions of change/reset password. OR shall we change the privileges on the current machine account and try adding again.. which one is the best practice...?

We're familiar of the machine or computer account which is used for authentication. Could you please let us know what does the ISE machine account do...?

[Colby LeMaire · Accepted solution]

You can try to remove the object and rejoin.  Whatever is easier for you.  If one ISE node is working but the other one is not, then just verify that all security group memberships are the same between the two objects in AD.

Every Windows client that joins Active Directory will have a computer account/password.  ISE acts just like a Windows client when joined.  It uses the same process as a Windows 10 machine to find the closest domain controller for authentication.  It needs its computer credentials to be able to authenticate other accounts and machines just like a Windows client would if you were trying to access resources on that system or trying to login to it.  ISE uses Centrify to be able to act like a Windows client.  Centrify is used by Linux machines in general when you want to have them join AD.

[Srinivasan Nagarajan]

Thanks Colby, Hope updating the machine account privileges of the ISE nodes (for the working) in AD, wont have/cause any disruption of services.