ISE AD-Host-Exists Profiling

[Alex Pfeil]

I have a profile condition setup so that if the AD-Host-Exists, then add some points and possibly profile a device as a domain device.  I have an iphone that does not AD-Host-Exists and it is matching the profile. Running ise 2.3.  Any ideas?

[Ben Walters]

Have you checked the profiler report?

Under Operations > Reports > Reports > Endpoints and Users > Profiled Endpoints Summary

If you look at the device details it should give you a bunch of information related to the profiling of the device, start there and you might see something that doesn't look right for your setup.

Hope that helps.

[mustafa83]

Hi Alex, 

This sounds alarming, was this ever resolved? the reason i'm asking because i'm using AD-Host-Exists for corporate windows machine in my dev. environment, but dont have iPhone on it yet. 

Thanks,

Mustafa

[hslai · Accepted solution]

Profiling Using the Active Directory (AD) Probe shows how this works. If a mobile device has the same hostname as an existing domain computer, then that becomes a false positive. I would recommend to use additional attributes to further differentiate.