Where are the failed AD users login attempts logs in ISE 2.7?

[ViktorVik36163]

Hello,

We have Cisco ISE 2.7.

In Operations>Reports>Audit>Administrator Logins tab we can't see any logs about AD users failed login attempts (wrong password issue). But we see logs about failed login attempts of the local administrators.

We upgraded from ISE 2.3 to ISE 2.7 recently. In the ISE 2.3 we could see logs about AD users failed login attempts, but in 2.7 we didn't.

In Administration>System>Logging>Logging Categories tab Failed Attempts category is enabled.

Is it possible to enable in ISE 2.7 logs about bad login attempts for users from AD? Or ISE 2.7 doesn't has these logs?

Please, help. Thanks!

[marce1000]

 - Check this thread : https://community.cisco.com/t5/network-access-control/where-is-the-failed-login-attempts-log-in-ise/td-p/2520564

 M.

[Marcelo Morais · Accepted solution]

Hi,

 you are right ... I tested on a 2.7 P3, the following happened:

User/Password: Event
1. Internal User + Wrong Password: Administrator authentication failed. Wrong password.
2. Internal User + Correct Password: Administrator authentication succeeded
3. External User + Wrong Password: <nothing>
4. External User + Correct Password: Administrator authentication succeeded
5. Wrong External User + Password: Administrator authentication failed

Please take a look at: CSCvx43566 No login fail log when using external username with Wrong Password.

Please open a TAC case to report this.

Hope this helps !!!