A change-control audit requires proof of the exact CLI commands two administrators ran on a core switch last Friday, and the team also wants to review failed login attempts from a contractor account. The switch already uses TACACS+ for authentication and authorization. Which ISE logging setup should the engineer enable?

TACACS+ command accounting records the commands administrators actually issue, so configuring the switch to send start-stop accounting records to ISE provides an audit trail of exact CLI activity. Reviewing the TACACS+ logs also lets the team examine authentication events, including failed contractor logins. Stop-only command accounting is a valid method for recording command activity, but relying on those accounting records does not reliably provide evidence of failed logins: failed authentication attempts are authentication events, not completed command-accounting records. TACACS+ command authorization and authentication-failure logging can show whether a requested command was permitted and document failed logins, but authorization records do not prove the command was subsequently executed. TACACS+ exec-session accounting and authentication-failure logging can document administrator sessions and failed logins, but session-level records do not capture each CLI command and therefore cannot establish the exact commands entered. Exam caveat: authorization, authentication, session accounting, and command accounting answer different audit questions; evidence that a command was allowed or that a session existed is not evidence that the command ran. Practical check: after enabling accounting, run a harmless test command and confirm ISE receives a command-level record with the expected administrator identity, command text, and timestamp, then verify a controlled failed login appears in the relevant TACACS+ authentication logs.