Hi everyone!
I'm setting up wireless BYOD with guest portal and having issues with the specific option on ISE - "Prevent active directory user lockout".
I turned this option on and tried to simulate locking out user account entering wrong password for his account.
![AD settings.png AD settings.png](/t5/image/serverpage/image-id/227544i2B772A36243F0F47/image-size/large?v=v2&px=999)
Fair enough, after 3 attempts ISE won't let me login anymore because it's locked on ISE even if I enter correct password:
![Radius error.png Radius error.png](/t5/image/serverpage/image-id/227542iD3BB84B47F73FE44/image-size/large?v=v2&px=999)
AD would block user in AD if badPwdCount gets to 5, so the account is still working for other services.
But now I'm having issues with unlocking the account on ISE. I tried to re-login to wired network using correct login/password to reset badPwdCount Attribute. After that I try to login to BYOD page portal and I still get the same "Selected Indentity Source is DenyAccess" like ISE doesn't care about badPwdCount at all.
I even checked the badPwdCount counter on ISE itself using "Test User" feature on ISE and it actually shows it's zero!
![test user.png test user.png](/t5/image/serverpage/image-id/227543iDE172DC87CEACEBE/image-size/large?v=v2&px=999)
Is there a chance ISE checking some other attributes? How do I troubleshoot why ISE specifically decide to lock me?
ISE 3.3.0.181 Patch 2