> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows accounts

> Give people remote desktop access to a Windows server with a local account.

A Windows account lets people open a remote desktop (RDP) session on one Windows server without seeing the account's password. They connect with an RDP client in the browser or with their own RDP client through the Infisical CLI, and Infisical records each [session](https://infisical.com/docs/documentation/platform/pam/sessions/overview).

To sign in to several servers with one Active Directory account, use a [Windows AD account](https://infisical.com/docs/documentation/platform/pam/accounts/windows-ad.md) instead.

> [!NOTE]
>
> Windows accounts are available under Infisical's [Enterprise](https://infisical.com/pricing) plan.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the server on its RDP port
* A Windows [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md) that stores recordings in [your own S3 bucket](https://infisical.com/docs/documentation/platform/pam/sessions/external-storage.md) (the default Windows template stores them in Infisical's database, so a Product Admin must change it or create another template)

## Create an account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** to add the account to and a Windows **Account Template**, then select **Next**.

**Step 3**

Enter a **Name** for the account and the server's connection details:

| Field | Description |
| - | - |
| **Host** | The server's hostname or IP address |
| **RDP Port** | The server's RDP port (defaults to `3389`) |
| **WinRM Port** | The server's WinRM port (defaults to `5985`) |
| **Use WinRM HTTPS** | Whether to connect to WinRM over HTTPS |
| **Gateway** | The Gateway that connects to the server (only shown if the template doesn't set one) |

Infisical uses WinRM for [credential rotation](https://infisical.com/docs/documentation/platform/pam/credential-rotation/windows.md), [credential health](https://infisical.com/docs/documentation/platform/pam/credential-health/overview.md) checks, and [dependency](https://infisical.com/docs/documentation/platform/pam/credential-rotation/windows.md#dependencies) detection, not for RDP sessions.

**Step 4**

Enter the **Username** and **Password** of the local Windows account.

> [!NOTE]
>
> Enter the username on its own, such as `svc-backup`, without a `.\` or computer name in front of it.

**Step 5**

Select **Create**.

## Connect

People can open a remote desktop in the browser or connect through the CLI. To learn how to launch a session, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md).

The CLI starts a local proxy and prints its port:

```bash theme={"dark"}
infisical pam access <folder>/<account>
```

Point your RDP client at `localhost` on that port, for example:

```bash theme={"dark"}
xfreerdp /v:localhost:<port>
```

Press `Ctrl+C` to end the session.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.