ISE Windows account??

[Michael Bartholomæussen]

I've inherited an ISE deployment and In our AD there is a ISE service account who is a domain admin.

Going through the ISE guides, I can that the service account need specific permission in AD, and I guess they've used a domain admin (the dirty way).

I want to rectify this by creating a new account with the specific permission, but I can't seem to find where the account is defined within ISE. The only account I can find (but not used in any way), is the AD join account.

So the question is, where do I find the other account in ISE?

[Damien Miller]

If this account was created to only join ISE to AD, then you don't need it anymore. When you join ISE to AD, the service account is only used to create a machine object within AD. From that point on, ISE leverages the AD computer object to perform lookups.

You should be able to find a computer object per ISE node that has been joined in the directory.

[Michael Bartholomæussen]

Hi Damien

Both nodes are present in AD, and "joined" under External Ident.

I've stepped through the guide again, and under "Set Permissions for Access to WMI Root/CIMv2 Name Space" the account is applied on our Domain controller. But I can't seem to find, where the user is defined in ISE (where the pwd is set)

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_01110.html#task_784A7F6991594B11B1BAD206FDCD249B

[Damien Miller]

When you join ISE to AD, the user name and password will be typed in to the GUI, but it is single use only. It's not saved after the join operation is completed on a node.

The user account you use to join ISE to AD is not used by ISE after the join is complete. The computer objects created while joining are what ISE leverages past the join operation.

[hslai]

The WMI thing is for Passive Identity.

Unless you are using that feature, you would not need the user credentials, just like Damien said.

[Damien Miller]

Passive identity is a good exception to note. I was thinking of this from strictly a node being joined to AD.

[Michael Bartholomæussen]

I haven't found the settings for the service account within ISE?

[Michael Bartholomæussen]

Editing the settings for the PassiveID Domain Controllers, the option is there to set the password for the service account. I had only been focusing on "Config WMI" and "Add Domain Controllers"