So if I type in the admin password incorrectly, it shows a Reject in Access Tracker with no Service attached to it;
Error Category: Authentication failure
Error Code: Failed to classify request to service
Tacacs server ServiceClassification failed, reason=PolicyServer returned empty service
If I type in the admin password correctly, it doesn't show up in Access Track, but I go get an INFO level event in the Event Viewer that admin has logged in.
I did follow the process here, https://blogs.arubanetworks.com/solutions/clearpass-operator-login-with-active-directory/, and AD Authentication works - I'm just confused as to where the original local admin login is being processed, unless its something that happens regardless of the services defined.