Cisco ISE AD Join Broken: show logging application ad-agent When Groups Vanish

Cisco ISE · Techclick CLI troubleshooting lab

User authenticates as a name but group conditions miss. AD join shows a red X.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco ISE for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

ISE must stay joined and able to query groups. ad-agent logs tell you if it is DNS, time, or a changed machine account password.

Why this ticket shows up

A failed join still lets some cached authentications through, so the outage looks like 'policy broke'.

Symptoms operators actually see

• AD join red

• Group fetch fails

• After a DC migration

• Clock skew

CLI first — copy this block

Run these on the Cisco ISE device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show logging application ad-agent.log tail 80
show ntp
show dns
show application status ise
nslookup corp.local

How to read that output

ad-agent will name the DC and the error (clock, LDAP, kerberos). Fix that before you rewrite policy sets.

Triage order

1. Read ad-agent errors

2. Fix DNS and NTP toward the new DCs

3. Leave and rejoin AD if the machine account is stale

4. Refresh groups

5. Retest a group-based policy

Classic traps

What you see	Real cause	Fix
Rewrite every policy to usernames	Join is red	Fix AD
Reboot ISE first	DNS still points at a dead DC	Fix DNS
Create local ISE users	This is an enterprise AD design	Rejoin

Proof the ticket is closed

• AD join green

• Groups populate

• Group condition hits

Say this in an interview

When group conditions miss, I check AD join before I edit authorization rules.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/