Hi Everyone,
I would like to know why ISE needs the ability to change own password in AD with the Machine account.
What is this functionality used for as this is flagged by a client?
The ISE/AD integration lists the requirements for the Machine account but does not specify why this functionality is required.
Below is the list of requirements from the guide for the ISE/AD Machine account:
- Set attributes on the machine account (for example, Cisco machine account password, SPN, DNS Hostname)
- Ability to change own password
- Read the user/machine objects corresponding to users/machines
- Query Active Directory to get information (for example, trusted domains, alternative UPN suffixes)
- Ability to read token Groups attribute
Appreciate your inputs.
Thanks.
A M Nassiri
