troubleshooting Question

Cisco ISE trying to use Super user credentials to access AD servers

Avatar of Deepak Muralidharan
Deepak MuralidharanFlag for Singapore asked on
Active DirectoryNetwork SecurityCiscoNetwork ManagementNetwork Operations
14 Comments1 Solution367 ViewsLast Modified:
Hi Experts,

Is there a way to check on Cisco ISE logs why it's using Some privileged account to access various AD servers around the global branches ?  Is there any setting or log filter show why or which device being acceSsed by ISE ?

Logs like below found on SIEM,
Caller computer name : \\ companyISE01
Caller IP address :
Account lock out : Administrator
Account lockout Domain: domain name

Subject account name : user account
Subject account domain: domain

Device host ame :
Device event class ID : Microsoft-windows -security - auditing:4740

This rule triggers on every instance windows event ID 4740- a user account was locked out.

Craig Beck
Network Architect and EE TA
Log in to continue reading
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform for $9.99/mo
View membership options
Unlock 1 Answer and 14 Comments.
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
The Value of Experts Exchange in My Daily IT Life

Experts Exchange (EE) has become my company's go-to resource to get answers. I've used EE to make decisions, solve problems and even save customers. OutagesIO has been a challenging project and... Keep reading >>


Owner of Outages.IO
Phoenix, Arizona, United States
Member Since 2016
Join a full scale community that combines the best parts of other tools into one platform.
Unlock 1 Answer and 14 Comments.
View membership options
“All of life is about relationships, and EE has made a virtual community a real community. It lifts everyone's boat.”
William Peck

Member since 2004