STEP #1 - find out if it's ISE or NON ISE

goto SPLUNK site


• click on "Active Directory"
• click on "User Objects"



• click on "Dashboards"





• click on "AD Objects - User - Audit"





• copy and paste user's email





• select "last 4 hours"





• click on the "Submit" button





• select "last 4 hours"





• under the Account Lockout Activity - User section you will find the ISE lockout source under the Workstation column - in this case it's "SDCISE02"





• take a screenshot of this section for your ticket and name it "username-splunk" - this is one of many screenshots you will need for an ISE lockout

STEP #2 - goto ISE site

goto ISE site


• take a screenshot of this section for your ticket and name it "username-splunk" - this is one of many screenshots you will need for an ISE lockout





• click on the "Operations" tab and then the "Live Logs" link under RADIUS





• input user's UR ID under the Identity header and hit Enter Key





• take a screenshot of all the unique mac address on this page and save the image as "username-ise" - also copy each unique mac address for your ticket

STEP #3 - goto MACVendor site

goto the MacVendors website


• enter each unique MAC address and take a screenshot and name the file "userid-mac1, userid-mac2, and etc"

STEP #4 - create a HEAT ticket

You need to gather the following info for the ticket


• CUSTOMER NAME
from Active Directory search for User Name by First and Last Name or UR email address




• UR Email
• double click on the he User's name from the Search results to load the User Details - copy the First Name, Last Name, Branch, and Email to your Notes





• Phone #
get the phone number from the user and add it to your notes
• Service Tag/Serial # of PC or Wyse
you can get the Service Tag/Serial # from the user or have them get it from the sysinfo icon from their Windows desktop - you need this to lookup the PC Name or you can get the PC Name from the sysinfo icon
• PC Name or Wyse Name - copy this to your notes and use Rentalman to lookup PC Name/Wyse Name using Service Tag/Serial #


From RM screen Main Menu - option 20/10/F7/F7/F7 to get to the All Locs screen - hit "F2" to search by service tag # or serial #




enter the service tag or serial number in the pink search box




copy the service tag or serial number, Device Name (pc name), and IP address if any to your notes





• IP address


if there is no IP address in Rentalman then bring up "CMD" command prompt and ping for the ip address using the PC Name - copy the IP address to your notes





• ISE screenshots
  • Splunk screenshots
  • ISE screenshot
  • MACVendor screenshots

• log into HEAT as Service Desk Analyst



• click on the "Incident" link on top and then click on the "New Incident" link





• serach for user name using first and last name or email





• From "Action Menu" drop down to select "Support Center" and then "Locked account (ISE)"





• enter the PC Name from notes





• enter the IP Address from notes





• enter the lockout source from notes





• enter all unique MAC addresses from notes





• enter branch location code from notes





• drop down the missing Subcategory to select "Network/AD"





• click on the "Link" icon to search for "SerialNo" and paste the service tag or serial # from notes





• click on "Search"





• click on the "Select" button to link asset





• paste phone number from notes





• click on the "Attach file" link to attach ISE screenshot, Splunk screenshot, and MACVendor screenshots





• hold down shift key and select all screenshots and then click on teh "Open" button to attach screenshots to ticket





• the front page of this ISE ticket is now complete