Showing results for 
Search instead for 
Did you mean: 

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.


ISE Windows account??

I've inherited an ISE deployment and In our AD there is a ISE service account who is a domain admin.

Going through the ISE guides, I can that the service account need specific permission in AD, and I guess they've used a domain admin (the dirty way).


I want to rectify this by creating a new account with the specific permission, but I can't seem to find where the account is defined within ISE. The only account I can find (but not used in any way), is the AD join account.


So the question is, where do I find the other account in ISE?

Damien Miller
VIP Advisor

If this account was created to only join ISE to AD, then you don't need it anymore. When you join ISE to AD, the service account is only used to create a machine object within AD. From that point on, ISE leverages the AD computer object to perform lookups.

You should be able to find a computer object per ISE node that has been joined in the directory.

Hi Damien


Both nodes are present in AD, and "joined" under External Ident.



I've stepped through the guide again, and under "Set Permissions for Access to WMI Root/CIMv2 Name Space" the account is applied on our Domain controller. But I can't seem to find, where the user is defined in ISE (where the pwd is set)



When you join ISE to AD, the user name and password will be typed in to the GUI, but it is single use only. It's not saved after the join operation is completed on a node.

The user account you use to join ISE to AD is not used by ISE after the join is complete. The computer objects created while joining are what ISE leverages past the join operation.

The WMI thing is for Passive Identity.

Unless you are using that feature, you would not need the user credentials, just like Damien said.

Passive identity is a good exception to note. I was thinking of this from strictly a node being joined to AD.

I haven't found the settings for the service account within ISE?

Editing the settings for the PassiveID Domain Controllers, the option is there to set the password for the service account. I had only been focusing on "Config WMI" and "Add Domain Controllers"
Recognize Your Peers
Content for Community-Ad

ISE Webinars

Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube