> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows Active Directory accounts

> Give people remote desktop access to Windows servers with an Active Directory account.

A Windows AD account lets people open a remote desktop (RDP) session as an Active Directory domain account without seeing its password. One account can sign in to several servers, and you choose which ones in the account's list of allowed hosts. People connect with an RDP client in the browser or with their own RDP client through the Infisical CLI, and Infisical records each [session](https://infisical.com/docs/documentation/platform/pam/sessions/overview).

To sign in to one server with a local Windows account, use a [Windows account](https://infisical.com/docs/documentation/platform/pam/accounts/windows.md) instead.

> [!NOTE]
>
> Windows AD accounts are available under Infisical's [Enterprise](https://infisical.com/pricing) plan.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach each allowed host on its RDP port
* A Windows AD [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) that stores recordings in [your own S3 bucket](https://infisical.com/docs/documentation/platform/pam/sessions/external-storage.md) (the default Windows AD template stores them in Infisical's database, so a Product Admin must change it or create another template)

## Create an account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** to add the account to and a Windows AD **Account Template**, then select **Next**.

**Step 3**

Enter a **Name** for the account and the domain's connection details:

| Field | Description |
| - | - |
| **FQDN** | The domain's fully qualified domain name, such as `corp.example.com` |
| **DC Address** | The hostname or IP address of a domain controller |
| **Allowed Hosts** | The hostnames or IP addresses of the servers people can connect to (one per line) |
| **LDAP Port** | The domain controller's LDAP port (defaults to `389`) |
| **RDP Port** | The RDP port of the allowed hosts (defaults to `3389`) |
| **Use LDAPS** | Whether to connect to the domain controller over LDAPS |
| **WinRM Port** and **Use WinRM HTTPS** | How to connect to WinRM (defaults to port `5985` over HTTP) |
| **Gateway** | The Gateway that connects to the hosts (only shown if the template doesn't set one) |

Infisical uses the domain controller and WinRM settings for [credential rotation](https://infisical.com/docs/documentation/platform/pam/credential-rotation/windows.md), [credential health](https://infisical.com/docs/documentation/platform/pam/credential-health/overview.md) checks, and [dependency](https://infisical.com/docs/documentation/platform/pam/credential-rotation/windows.md#dependencies) detection, not for RDP sessions.

**Step 4**

Enter the **Username** in `DOMAIN\username` format, such as `CORP\Administrator`, and the **Password**.

**Step 5**

Select **Create**.

## Connect

People can open a remote desktop in the browser or connect through the CLI. To learn how to launch a session, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md).

If the account has more than one allowed host, select the **Host** to connect to when you launch the session. In the CLI, pass the host with `--target`:

```bash theme={"dark"}
infisical pam access <folder>/<account> --target <host>
```

The CLI starts a local proxy and prints its port. Point your RDP client at `localhost` on that port, for example:

```bash theme={"dark"}
xfreerdp /v:localhost:<port>
```

Press `Ctrl+C` to end the session.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.