ISE Local Accounts Disabling

[James Davies]

ISE - 2.3.0.298

We use our ISE for Device Administration and it hooks up with AD no problem, We have some users who require RO Access, I created local accounts and this also works fine, except the accounts get disabled overnight for no reason.

I have set passwords to not expire for 3 years under account disable policy. Any help appreciated.

[4aaronharrison4]

We're also experiencing this behavior with a "service" account we configured locally on ISE 2.3 for Solar Winds jobs.  This account is set to not disable at all and seems to become disabled intermittently.

Help reviewing logs to see why this is happening would be appreciated!

[desmond.cassidy]

Help reviewing logs to see why this is happening would be appreciated!

User identify account disabled - re-enabled it and its working fine but the user would like an explanation why it got disabled. Why logs or checks can I carry out to find the reason why ?

[salman abid]

Hi James,

By any chance you got fix of this problem? i'm also facing the same issue.

[nspasov · Accepted solution]

Please check the following settings:

Administration > Identity Management > Settings > User Authentication Settings:

- Disable user account after "Value" days if password was not changed

- Lock/Suspend Account with incorrect login attempts

Administration > Identity Management > Identities > Edit User Account:

- Account Disable Policy

Thank you for rating helpful posts!

[Jeff Lawrence]

I had this happen to me as well this morning. We are using a local account in the ISE db for a couple of monitoring servers that monitor all devices on our network via TACACS.  I checked the settings as requested and the only option that was enabled was 'Disable account after 60 days'.  But the entire system was turned up less than a month ago, from scratch.  Seems odd that would be the cause. I turned that option off and I guess we will see if it happens again.  I am still scouring the logs to try and find a reason why.  

Thanks

Jeff

[Alex Mac]

Hi nspasov,

it's not clear to me if your answer relates to the original post or all of three. In my case we use AD.

May you just confirm please?

Thanks

[hslai]

Neno's solution is correct for all the other comments in this thread, as it's for ISE internal users.

Your case is using AD, then you would need to check AD password policy.

[Alex Mac]

---

@hslai wrote:

Neno's solution is correct for all the other comments in this thread, as it's for ISE internal users.

Your case is using AD, then you would need to check AD password policy.

I thought I could protect the AD infrastructure with this mechanism that looks like the Max failed 802.1x

attempts available on the WLC. But OK, thanks for confirming that it has another scope. Pity.

[Beartrap124]

I'm sorry, but this is not clear to me. Should we make sure that the radial buttons for these settings ARE checked? Or are you stating that we should check IF these settings are set? 

We are also having this same issue, and none of these options are enabled.