Skip to main content
Active Directory discovery finds the users in an Active Directory domain, and optionally the local accounts on its Windows servers, so you can import them into PAM. For how discovery works across every source type, see Discovery. A scan finds two types of account: The scan can also find the dependencies of the accounts it finds, which are the services, scheduled tasks, and IIS application pools that run as them. Infisical connects to the domain controller and the servers through a Gateway, signed in as a Windows AD account that you choose for the source.
  1. Infisical connects to the domain controller over LDAP or LDAPS, using the connection settings of the source’s Windows AD account, and lists the domain’s users
  2. If Discover local accounts or Discover account dependencies is on, Infisical also lists the domain’s Windows servers, and resolves each server’s hostname through the domain controller’s DNS
  3. Infisical connects to each server over WinRM to list its local accounts, the dependencies of the accounts it found, or both
If Infisical can’t reach a server over WinRM, the scan reports the server and continues with the others.

​
Prerequisites

  • A Gateway that can reach your domain controller, and your Windows servers if you turn on Discover local accounts or Discover account dependencies
  • A Windows AD account with a password, to sign in to the domain with
  • The Product Admin role in PAM
  • The Connector, Operator, or Admin role on that Windows AD account
To find local accounts or dependencies, you also need:
  • WinRM turned on for your Windows servers
  • A domain controller whose DNS resolves each server’s hostname

​
Step 1: Create a source

1
Go to Privileged Access Management > Discovery and select Add Source.
2
Select Active Directory, then select Next.
3
Configure the source:Infisical connects to the domain controller with the domain, address, ports, and LDAPS settings of the Windows AD account.
4
If you turned on Discover local accounts or Discover account dependencies, configure how Infisical connects to your servers over WinRM:
5
Select Add Source.

​
Step 2: Run a scan

On the Discovery Sources table, select the options menu on the source’s row, then select Scan Now. A source can run one scan at a time.

​
Step 3: Import accounts

1
On the Discovery Sources table, select the source.
2
On the Staged Accounts tab, select the accounts you want, then select Import Accounts.
3
Select a Destination Folder, then a template for each account type in your selection (Windows AD Template, Windows Template, or both).
4
To have Infisical set a new password on each account during the import, turn on Rotate account passwords on import. Then, for each account type in your selection, pick the rotation account that Infisical signs in as to change the passwords:
  • Windows AD Rotation Account: an account in the same domain (by default, the source’s credential account)
  • Windows Rotation Account: a local account, which can only rotate the local accounts on its own server
If you leave a field empty, Infisical imports accounts of that type without a password.
Rotation changes each account’s password in Active Directory or on its server, so anything that signs in with the old password stops working. If the scan found the account’s dependencies, Infisical updates them with the new password.
5
Select Import.
6
Go to Privileged Access Management > Accounts. The scan doesn’t read passwords, so each imported account that Infisical didn’t rotate shows Unavailable until you set its password. For each of those accounts, open the options menu on its row, select Configure, and enter its password on the Configuration tab.
Your Active Directory accounts are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new accounts it finds.