Using ISE to authenticate windows users (no Active Directory)

[Tod Larson]

I am trying to design a system where we have lots of routers/switches but only a few windows machines.  We have a couple window PCs and servers for network management tools.  This network management system is independent and physically separate from our corporate active directory.  It's small enough so we don't need AD.  We have local logons and do local group policy to lock down the windows machines.  We use TACACS+ on ISE  for user authentical for the several hundred routers and switches, but we then have local accounts for the windows computers.    We don't want to deploy AD and have yet another thing to manage and patch (I get that isn't not super hard, but zero work is better).

Can we configure a windows computer to authenticate users against ISE?   

[Jason Kunst]

Yes. Ise has an internal user store and that can be used

[Tod Larson]

Can I use the ISE internal user store to authenticate a user logging into a Windows 10 laptop? 

[Jason Kunst]

Yes works the same way as AD just the user is created on ise internal database as a network access user .

https://www.cisco.com/c/en/us/td/docs/security/ise/2-3/admin_guide/b_ise_admin_guide_23/b_ise_admin_guide_23_chapter_01110.html

[Tod Larson]

Jason,

Thank you for posting but I'm not sure we are communicating.

I don't see in the link you provide where to configure my Windows 10 laptop to authenticate a Windows user with the ISE internal user store.  I want to be able to log into my windows laptop using ISE.   I would expect to have to configure some local Windows policy to point Windows at the ISE for authentication.  But I might be missing something.

Thank you.

[Jason Kunst · Accepted solution]

Ok you’re looking for ise to act as a domain controller ? No this is not possible it’s not active directory. You would create local users to login to the machines and these accounts can match those on ise to login to the network

[Tod Larson]

That is what I was afraid of but at least now I know for sure. 

Thank you for the assistance.