STEP #1 - find out if it's ISE or NON ISE
- goto SPLUNK site
- click on "Active Directory"
- click on "User Objects"
- click on "Dashboards"
- click on "AD Objects - User - Audit"
- copy and paste user's email
- select "last 4 hours"
- click on the "Submit" button
- select "last 4 hours"
- under the Account Lockout Activity - User section you will find the ISE lockout source under the Workstation column - in this case it's "SDCISE02"
- take a screenshot of this section for your ticket and name it "username-splunk" - this is one of many screenshots you will need for an ISE lockout
![](https://jiawp.neocities.org/ise001-1.png)
![](https://jiawp.neocities.org/ise002-2.png)
![](https://jiawp.neocities.org/ise003.png)
![](https://jiawp.neocities.org/iseemail.png)
![](https://jiawp.neocities.org/ise4hours.png)
![](https://jiawp.neocities.org/isesubmit.png)
![](https://jiawp.neocities.org/ise4hours.png)
![](https://jiawp.neocities.org/iselockout.png)
![](https://jiawp.neocities.org/isess.png)
STEP #2 - goto ISE site
- goto ISE site
- take a screenshot of this section for your ticket and name it "username-splunk" - this is one of many screenshots you will need for an ISE lockout
- click on the "Operations" tab and then the "Live Logs" link under RADIUS
- input user's UR ID under the Identity header and hit Enter Key
- take a screenshot of all the unique mac address on this page and save the image as "username-ise" - also copy each unique mac address for your ticket
![](https://jiawp.neocities.org/iseise2.png)
![](https://jiawp.neocities.org/iselive2.png)
![](https://jiawp.neocities.org/isename2.png)
![](https://jiawp.neocities.org/iseunique2.png)
STEP #3 - goto MACVendor site
- goto the MacVendors website
- enter each unique MAC address and take a screenshot and name the file "userid-mac1, userid-mac2, and etc"
![](https://jiawp.neocities.org/isemac.png)
STEP #4 - create a HEAT ticket
got to HEAT site- You need to gather the following info for the ticket
- CUSTOMER NAME from Active Directory search for User Name by First and Last Name or UR email address
- UR Email
- double click on the he User's name from the Search results to load the User Details - copy the First Name, Last Name, Branch, and Email to your Notes
- Phone # get the phone number from the user and add it to your notes
- Service Tag/Serial # of PC or Wyse you can get the Service Tag/Serial # from the user or have them get it from the sysinfo icon from their Windows desktop - you need this to lookup the PC Name or you can get the PC Name from the sysinfo icon
- PC Name or Wyse Name - copy this to your notes and use Rentalman to lookup PC Name/Wyse Name using Service Tag/Serial #
- IP address
- ISE screenshots
- Splunk screenshots
- ISE screenshot
- MACVendor screenshots
![](https://jiawp.neocities.org/isead.png)
![](https://jiawp.neocities.org/iseuser2.png)
From RM screen Main Menu - option 20/10/F7/F7/F7 to get to the All Locs screen - hit "F2" to search by service tag # or serial #
![](https://jiawp.neocities.org/iserm2.png)
enter the service tag or serial number in the pink search box
![](https://jiawp.neocities.org/iserm333.png)
copy the service tag or serial number, Device Name (pc name), and IP address if any to your notes
![](https://jiawp.neocities.org/iserm333-1.png)
if there is no IP address in Rentalman then bring up "CMD" command prompt and ping for the ip address using the PC Name - copy the IP address to your notes
![](https://jiawp.neocities.org/iseping2.png)
- log into HEAT as Service Desk Analyst
- click on the "Incident" link on top and then click on the "New Incident" link
- serach for user name using first and last name or email
- From "Action Menu" drop down to select "Support Center" and then "Locked account (ISE)"
- enter the PC Name from notes
- enter the IP Address from notes
- enter the lockout source from notes
- enter all unique MAC addresses from notes
- enter branch location code from notes
- drop down the missing Subcategory to select "Network/AD"
- click on the "Link" icon to search for "SerialNo" and paste the service tag or serial # from notes
- click on "Search"
- click on the "Select" button to link asset
- paste phone number from notes
- click on the "Attach file" link to attach ISE screenshot, Splunk screenshot, and MACVendor screenshots
- hold down shift key and select all screenshots and then click on teh "Open" button to attach screenshots to ticket
- the front page of this ISE ticket is now complete
![](https://jiawp.neocities.org/iseheat.png)
![](https://jiawp.neocities.org/ss0152.png)
![](https://jiawp.neocities.org/ss0162.png)
![](https://jiawp.neocities.org/ss017.png)
![](https://jiawp.neocities.org/ss018.png)
![](https://jiawp.neocities.org/sss001.png)
![](https://jiawp.neocities.org/sss002.png)