ISE Authenticaiton issue

[Maurice Ball]

Does Cisco ISE use Windows "Pre Windows 2000 Compatible Access" security group in Active Directory to retrieve users and security group information from Active Directory? The reason I am asking is we remove the "Authenticated User's" from the security group "Pre Windows 2000 Compatible Access" and authentication started to fail for users. Note: The ISE nodes are part of the "Authenticated User's" group. We also noticed a error on ISE stating it could no longer retrieve user and group information from Active Directory. We added the nodes back to the "Pre Windows 2000 Compatible Access" individually and restarted the nodes and the issue resolved. I am not sure if it was the restart or the adding the nodes back to the security group is what solve the issue.

[balaji.bandi]

what ISE version - check the compatability matrix :

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/compatibility_doc/b_ise_sdt_31.html

I am not sure if it was the restart or the adding the nodes back to the security group is what solve the issue.

- looks for me some connection broken between which resolved by restart or readd ? (windows restart fix many issue) - (that does not mean ISE have no bugs at all.)

[thomas · Accepted solution]

By searching the Internet for ISE "Windows 2000 Compatible Access" I found

https://community.cisco.com/t5/network-access-control/ise-2-3-and-active-directory-probe/td-p/3351475 which says it is required in ISE 2.x.

Also, when I search the ISE 3.3 Admin Guide for "pre-windows" I find

Active Directory as an External Identity Source

Cisco ISE uses Microsoft Active Directory as an external identity source to access resources such as users, machines, groups, and attributes. User and machine authentication in Active Directory allows network access only to users and devices that are listed in Active Directory.

After a Cisco ISE node joins Active Directory, in Active Directory, it is a member of the Authenticated Users group. The Authenticated Users group is a member of the Pre-Windows 2000 group by default. If you disable the Pre-Windows 2000 group or remove Authenticated Users from the Pre-Windows 2000 group, authentication failures occur.

We recommend that you do not disable the Pre-windows 2000 group. However, if you must disable this group for any reason, grant the Read Remote Access Information permission to Cisco ISE in AD for the relevant users or users' folders.

[Maurice Ball · Accepted solution]

Thanks, this is exactly what I needed to know.