Deregister a Node from an ISE Deployment

• Issue
• Environment
• Resolution
• Impact Assessment:
• Before Deregistering:
• Deregistration Steps:
• Cause
• Related Content

---

Issue

You need to deregister a target node from the Cisco Identity Services Engine (ISE) deployment.

Environment

• Cisco ISE version: version 3.1 and later

• Deployment type: Distributed

• Policy Administration Node (PAN)

• Monitoring Node (MNT)

• Policy Service Node (PSN)

• Network Access Device (NAD), for example, switch or wireless controller

Resolution

Impact Assessment:

• If deregistering the Primary PAN, promote a Secondary PAN to Primary first.

  • The Primary PAN cannot be deregistered directly.

• If deregistering a PSN:

  • Confirm a remaining PSN is available.

  • Confirm NADs are configured to direct the RADIUS and TACACS+ authentications to remaining PSNs.

  • Test authentication with remaining PSNs.

• If deregistering an MNT:

  • Confirm a remaining Monitoring node is available.

• Verify no sync operations are in progress on remaining nodes.

Before Deregistering:

If you intend to rebuild and/or reregister the deregistered target node later, you must document the target node configuration before deregistering.

Deregistration Steps:

1. Log in to the Primary PAN GUI.

2. Navigate to Administration > System > Deployment.

3. Select the target node to be removed.

4. Click Deregister.

1. Confirm the action when prompted.

2. Verify the node no longer appears in Administration > System > Deployment.

Cause

This process can be required for:

• Decommissioning or rebuilding ISE nodes.

• Hardware replacement.

• Topology changes.

• Resolving persistent synchronization / replication failures.

Related Content

• Export Configuration and Operation Data Backup from ISE

• Understand ISE 3.3 Node Registration Process

Revision History

Revision	Publish Date	Comments
2.0	16-Sep-2026	Updated Alt Text and Formatting.
1.0	19-Aug-2026	Initial Release