Windows domain admin users are not able to authenticate via ISE with AD when logging on to troubleshoot a remote PC. It looks like this is due to a bug "AD Protected Accounts not supported with ISE." https://bst.cloudapps.cisco.com/bugsearch/bug/CSCv...