MAR Cache valid but user machine password (PC-AD) updated-Cisco ISE

[anilkumar.cisco]

Hello Team,

if MAR Cache valid but user machine AD Password updated..

Do this PC would still be connected to the nework?

or ISE will remove this PC from the network because its machine password has changed?

This is genral question.. i am asking not related to any ISE version..

[thomas · Accepted solution]

ISE should not remove the computer because it's machine password changed.

That is an out-of-band change that happens with Microsoft and ISE would not know about it.

Microsoft AD does not issue calls to ISE when passwords are changed.

Use TEAP if you are worried about MAR Cache - it is designed to prevent needing to worry about MAR cache!

https://cs.co/ise-resources :

• TEAP for Windows 10 using Group Policy and ISE TEAP Configuration
• EAP Chaining with TEAP