ISE AD passive ID

[wileong]

Hi,

We are positioning ISE Base for AD passive ID. Part of ISE passive ID on AD require some changes in AD. Upon checking on the documentation, the following is the requirement

• Set Permissions When AD User in the Domain Admin Group
• Required Permissions when AD User not in Domain Admin Group
• Permissions to Use DCOM on the Domain Controller
• Set Permissions for Access to WMI Root/​CIMv2 Name Space
• Grant Access to the Security Event Log on the AD Domain Controller
• 
  

My customer is not comfortable with changing AD setting and registry. Understand that there is a ISE agent auto configuration, does the ISE automation perform the same as above?

If my customer is not comfortable with the above steps, what option do we have? SPAN?

Thanks

Wing Churn

[Timothy Abbott · Accepted solution]

Hi,

The "Config WMI" button automates the required steps to remotely monitor AD logon events.  The agent is less intrusive because it is a native windows application.  The agent can be install on the controller itself or on a member server that will then monitor the DC.  If either approach is unacceptable, the customer can either use kerberos SPAN or syslog.

Regards,

-Tim