cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Announcements
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

506
Views
5
Helpful
7
Replies
Highlighted
Beginner

ISE Windows account??

I've inherited an ISE deployment and In our AD there is a ISE service account who is a domain admin.

Going through the ISE guides, I can that the service account need specific permission in AD, and I guess they've used a domain admin (the dirty way).

 

I want to rectify this by creating a new account with the specific permission, but I can't seem to find where the account is defined within ISE. The only account I can find (but not used in any way), is the AD join account.

 

So the question is, where do I find the other account in ISE?

7 REPLIES 7
Highlighted
VIP Advisor

If this account was created to only join ISE to AD, then you don't need it anymore. When you join ISE to AD, the service account is only used to create a machine object within AD. From that point on, ISE leverages the AD computer object to perform lookups.

You should be able to find a computer object per ISE node that has been joined in the directory.
Highlighted

Hi Damien

 

Both nodes are present in AD, and "joined" under External Ident.

 

 

I've stepped through the guide again, and under "Set Permissions for Access to WMI Root/CIMv2 Name Space" the account is applied on our Domain controller. But I can't seem to find, where the user is defined in ISE (where the pwd is set)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_01110.html#task_784A7F6991594B11B1BAD206FDCD249B

 

 

Highlighted

When you join ISE to AD, the user name and password will be typed in to the GUI, but it is single use only. It's not saved after the join operation is completed on a node.

The user account you use to join ISE to AD is not used by ISE after the join is complete. The computer objects created while joining are what ISE leverages past the join operation.
Highlighted

The WMI thing is for Passive Identity.

Unless you are using that feature, you would not need the user credentials, just like Damien said.

Highlighted

Passive identity is a good exception to note. I was thinking of this from strictly a node being joined to AD.

Highlighted

I haven't found the settings for the service account within ISE?

Highlighted

Editing the settings for the PassiveID Domain Controllers, the option is there to set the password for the service account. I had only been focusing on "Config WMI" and "Add Domain Controllers"