ISE: AD Account Locked trying to authenticate on SSID

[Nicolai Borchorst]

Hi

I'm using EAP-MSCHAPv2 to authenticate wireless clients against Active Directory when joining the corporate SSID.

When the clients accidentally type their username or password wrong 3 times the whole AD Account is locked out meaning they can't even log onto a wired domain computer.

Are there any way of disabling this? I'm aware that ISE does nothing but proxy the credentials and results to AD, so the change is most likely to be on the AD server, but i have't been able to find a solution.

[agrissimanis]

From the Active Directory perspective this would be configured with Group policy. You would need to modify the default account lockout threshold. Have a look at this Technet article. Consider the consequences carefully before modifying these settings, if you disable AD user lockout, you could make brute force attacks much easier, etc.

[ajc · Accepted solution]

Getting locked out has nothing to do with ISE. However, you would probably like to match AD against ISE Suppresion List. We aware that there is also an Exclusion List on the WLC so probably you need to match WLC-ISE-AD values.

[Nicolai Borchorst]

Thank you for the reply.

This looks really helpful, wouldn't these changes to Radius however affect both wired and wireless clients meaning that wired machines would also be suppressed?

[ajc]

Based on my understanding, yes.