User for Integration ISE - AD

[Fabio Bustamante]

Hi everyone. This should be an easy question, but I need quick help.

We are going to deploy ISE in our network and we need to integrate to AD server. I read we need the following user in order to do that:

AD account required for domain access in ISE should have either of these:

• Add workstations to domain user right in corresponding domain
• Create Computer Objects or Delete Computer Objects permission on corresponding computers container where ISE machine's account is created before joining ISE machine to the domain

So, basically, we could use a domain admin user (I understand we don't store the credentials and we just need someone to enter that user/password once, is that right?) But AD administrators are asking us to explain exactly what is that account going to do, what is it going to read, what accions will be done on the servers. The only thing we know is that a machine account will be created, but we don't know what that account does, what permissions it has, how does it work reading AD Groups and authenticating users, we know nothing. Can someone please explain a little bit about it? They're concerned about security.

Any help appreciated.

Thank you.

[agrissimanis · Accepted solution]

Correct, that account will only be used to join ISE nodes to the domain. By default AD allows even regular non-admin accounts to join computers to the domain. Afterwards that account is not used at all.

ISE AD operations (group lookups, etc) are handled by the computer objects that get created when you join the nodes to the domain. These computer objects behave very much like Windows native computer accounts - they refresh their own passwords with the domain and so on. You can see that activity in the AD Connector operations report from the Reports menu.