Hi!
I know this is well know but we have all dealt with an IT department that needs to know why this or that privilege is needed for this account.
On Cisco documentation this is said:
The Active Directory username that you provide when joining to an Active Directory domain should be predefined in Active Directory and must have one of the following permissions:
–
Add the workstation to the domain to which you are trying to connect.
– On the computer where the Cisco ISE account was created, establish permissions for creating or deleting computer objects before joining Cisco ISE to the domain.
– Permissions for searching users and groups that are required for authentication.
After you join Cisco ISE to the Active Directory domain, you will still need these permissions to:
– Join any secondary Cisco ISE servers to this domain
– Upgrade Cisco ISE to a higher version, if the upgrade process involves a backup and restore
I have used users with "Permissions for searching users and groups that are required for authentication" and have received an error that said that needed a user with rights to add computers to the domain. When this user type was created then I had no problem.
So the real questions are:
Why does ISE need this permission?
What is the foundation for this?
why does ISE need to add workstations if the only thing ISE should be doing is searching for users?
