THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.
| Affected Software Product | Affected Release | Affected Release Number | Comments | 
|---|---|---|---|
| Identity Services Engine System Software | 3 | 3.1.0, 3.2.0, 3.3.0, 3.4.0 | For ISE releases 3.1 P10 and earlier For ISE releases 3.2 P7 and earlier For ISE releases 3.3 P7 and earlier For ISE releases 3.4 unpatched and P1 | 
| Defect ID | Headline | 
| CSCwn62873 | Cisco Identity Services Engine (ISE) fails to join Microsoft Active Directory (AD) domains hosted on Windows Server 2025 | 
Cisco Identity Services Engine (ISE) fails to join Microsoft Active Directory Domain Services (AD DS) that are hosted on Windows Server 2025. This prevents Cisco ISE from establishing a trusted connection with the Active Directory (AD) environment, which impacts services that rely on an AD integration, such as the following:
Microsoft Windows Server 2025 introduces several changes to AD DS that affect password handling. One of the key changes involves the Legacy Security Account Manager (SAM) Remote Procedure Call (RPC) password change behavior.
In Windows Server 2025, secure protocols, such as Kerberos, are the preferred method for domain user password changes. On domain controllers, the latest SAM RPC password change method, SamrUnicodeChangePasswordUser4, which uses Advanced Encryption Standard (AES), is accepted by default when called remotely.
However, the following legacy SAM RPC password change methods are now blocked by default when called remotely:
Additionally, for domain users that are members of the Protected Users group and for local accounts on domain member computers, all remote password changes through the legacy SAM RPC interface are blocked by default — including SamrUnicodeChangePasswordUser4.
These changes impact the ability of Cisco ISE to join Active Directory domains hosted on Windows Server 2025, as the integration process relies on password change mechanisms that are no longer permitted by default.
For more details, see What's New in Windows Server 2025.
When Cisco ISE attempts to join Microsoft AD hosted on Windows Server 2025, the operation fails.
Steps to Reproduce Join Operation Failure
If the AD admin user has the password does not expire option enabled, the following error is observed:
The following screenshot shows the error as it appears during the join attempt:

If the AD admin user has the password does not expire option disabled, the following error is observed:
The following screenshot shows the error as it appears during the join attempt:

Note: This problem occurs when attempting to join Cisco ISE to AD on Windows Server 2025 for the first time. Existing Cisco ISE–AD integrations continue to function after a Windows Server upgrade until the Cisco ISE appliance account password expires and a password change is required.
Solution
To address this issue, both a Cisco ISE software update and a Windows Server 2025 Domain Controller (DC) Group Policy configuration change are required:
1. Update the Cisco ISE software
Customers must open a TAC case to obtain the required hot patch. Hot patches are available for the following Cisco ISE releases:
2. Update Domain Controller Group Policy configuration
On the Windows Server 2025 Domain Controller:
Note: gpedit.msc (Group Policy Editor) modifies the local machine policy, which can be overridden by a domain-level Group Policy Object (GPO). If a domain-level change is required, use gpmc.msc (Group Policy Management Console) and apply the same steps through the domain GPO.
| Version | Description | Section | Date | 
| 1.0 | Initial Release | — | 2025-OCT-29 | 
For further assistance or for more information about this field notice, contact the Cisco Technical Assistance Center (TAC) using one of the following methods:
To receive email updates about Field Notices (reliability and safety issues), Security Advisories (network security issues), and end-of-life announcements for specific Cisco products, set up a profile in My Notifications.

Unleash the Power of TAC's Virtual Assistance