Trouble setting up AD integration with ISE

[brianjthornton]

We setup a service account to use with ISE for AD integration...however when I try and go through the steps to join:

Join Operation Failed: The account's computer join limit has been exceeded.

If I use a domain admin account...it works...BUT...that's not ideal.  Domain users have a default 10 adds per day...not sure why it's failing?

Any thoughts?

[Marvin Rhoads]

In a couple of dozen deployments, I've never had a problem using a dedicated service account to join ISE to AD.

At first glance it sounds like an AD issue. Are you using a new service account dedicated to ISE?

Are you using a recent ISE version?

[brianjthornton]

ISE 2.0

New Service Account created just for this.

I've reached out to the sysadmins to see what they say...it's just weird

[wenqianyu]

Hi Brian,

I have exactly the same problem when testing ISE 2.2. How did you get around this?

Thanks,

Wenqian Yu

[agrissimanis]

Not sure why a newly created account would have the join limit exceeded, but is there a particular reason why you would want to use a dedicated account or service account to join the ISE nodes to AD (AD permissions I guess)?

That account is used only once, for the join operation. It is not used at all for any of the other ISE authentication operations/group lookups, the ISE node computer account does that.

[wenqianyu]

We use an existing Service Account for our ISE system to get newly added nodes join Domain. I do think there is a limit for this type of account to get servers join Domain. Will find this out from Domain Admin.

[ajc]

When you test the service account (using ISE option) before trying to join it to AD, what is the error you are getting?. Using our AD service account I was able to join our distributed environment with 4 Admin Nodes + 10 PSN's.

[wenqianyu]

We experience issues when adding new ISE nodes to Active Directory. If the server name was already in Active Directory, link ISE node to Active Directory was successful. If the ISE node was not in Active Directory, the process should create an computer account for this server in Active Directory and then do the link. The error we got indicating that the service account reached to a limit creating an account in AD.

Workaround: I asked our system admin to create computer accounts in AD. Then link ISE Nodes to AD was successful.

Thanks