Deregister a Node from an ISE Deployment

Available Languages

Download Options

PDF (99.3 KB)
View with Adobe Reader on a variety of devices
ePub (167.2 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (150.1 KB)
View on Kindle device or Kindle app on multiple devices

Updated:August 19, 2026

Document ID:226276

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Issue

You need to deregister a target node from the Cisco Identity Services Engine (ISE) deployment.

Environment

Cisco ISE version: version 3.1 and later
Deployment type: Distributed
Policy Administration Node (PAN)
Monitoring Node (MNT)
Policy Service Node (PSN)
Network Access Device (NAD), for example, switch or wireless controller

Resolution

Impact Assessment

If deregistering the Primary PAN, promote a Secondary PAN to Primary first.
- The Primary PAN cannot be deregistered directly.
If deregistering a PSN:
- Confirm a remaining PSN is available.
- Confirm NADs are configured to direct the RADIUS and TACACS+ authentications to remaining PSNs.
- Test authentication with remaining PSNs.
If deregistering an MNT
- Confirm a remaining Monitoring node is available.
Verify no sync operations are in progress on remaining nodes.

Before Deregistering

If you intend to rebuild and/or reregister the deregistered target node later, you must document the target node configuration before deregistering.

Take a full configuration backup of the deployment.
Document the target node ISE deployment settings:
1. Log in to the Primary PAN GUI.
2. Navigate to Administration > System > Deployment.
3. Check-mark the target node do be deregistered and select Edit.
4. Make notes or take screenshots of the entire configuration in both of the General Settings and Profiling Configuration tabs.
Document the target node system certificates:
1. Navigate to Administration > Certificates > System Certificates.
2. Expand the target node entry.
3. Make notes or take screenshots of the entire certificate configuration of the target node.
4. Select each certificate Used By the target node ISE components one at a time, and Export the certificates and private keys.
5. Make a note of the passwords you create when exporting each certificate.
  - Note that you cannot re-import a certificate and key without the password.
Document the target node running system configuration:
1. SSH and log into the target node.
2. Run this command to show the running configuration and save the output to a text file.