NTLM Disabled and ISE-PIC

[mcvosi]

We recently disabled NTLM on our network, and now ISE-PIC is no longer seeing user sessions.

I have agents on the DCs and thought that would address it, but no.

[mcvosi]

I would say so; users are no longer identified. Cisco has no solution for this?

[mcvosi]

With NTLM attacks on the rise, how can Cisco continue to use it with ISE?

[Marvin Rhoads]

If your use case is getting information into FMC, ISE-=PIC is no longer required as of FMC 7.6+.

There is a new Passive Identity Agent that installs directly on your Windows DC(s) and reports back to FMC securely over TLS.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/m_user-control-with-the-passive-identity-agent.html