Cisco ISE – Admin GUI Account Locked After 45 Days

This is a quick post to describe the default behavior of the admin user GUI access in ISE, which gets locked after 45 days, if you haven’t changed the password. You’ll get something like this in the GUI:

While GUI access is prevented, you can still login via SSH and that’s how you’re going to recover the account. SSH to ISE using the admin account. Then issue the following command:

ise01/admin#application reset-passwd ise admin
Enter new password:
Confirm new password:

Password reset successfully.

If you want to change the password policy, go to Administration -> Admin Access under System and click Password Policy:

Notice the checkbox that says that the account expires after 45 days:

Uncheck this box if you don’t want to have the account expire:

Don’t forget to click Save. That’s it! That’s how you recover the account and prevent it from happening again. Note that this is for a private lab. You should adhere to any policies you have on password rotation in your organization.