Question on ISE machine account on Active Directory

[smukai]

I have a question on the ISE machine account that needs to be created on Active Directory: Why does it want ability to change its own password?

http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/ISE-ADIntegrationDoc/b_ISE-ADIntegration.html#reference_F19556CAD5C949B58DF89334E2C6255D

> Active Directory Account Permissions Required for Performing Various Operations

>  Cisco ISE Machine Accounts

>   * Ability to change own password

Thank you!

[howon · Accepted solution]

It is MS requirement. All machines joined to the domain are required to change its password periodically. I believe the default interval is per 90 days. Many think that the password is set by the AD server, but that is not the case, the password is generated from the machine and updated to the AD server which is why that permission is needed.

[smukai]

I believe this answers my question.  Thank you very much!