> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Active Directory discovery > Scan an Active Directory environment for domain and local Windows accounts. Active Directory discovery finds the users in an Active Directory domain, and optionally the local accounts on its Windows servers, so you can import them into PAM. For how discovery works across every source type, see [Discovery](https://infisical.com/docs/documentation/platform/pam/discovery/overview). A scan finds two types of account: | Account type | What the scan finds | When | | - | - | - | | [Windows AD](https://infisical.com/docs/documentation/platform/pam/accounts/windows-ad.md) | The domain's user accounts | Every scan | | [Windows](https://infisical.com/docs/documentation/platform/pam/accounts/windows.md) | The local accounts on the domain's Windows servers | If **Discover local accounts** is on | The scan can also find the [dependencies](https://infisical.com/docs/documentation/platform/pam/credential-rotation/windows.md#dependencies) of the accounts it finds, which are the services, scheduled tasks, and IIS application pools that run as them. Infisical connects to the domain controller and the servers through a [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md), signed in as a Windows AD account that you choose for the source. > [accordion] How a scan works > > 1. Infisical connects to the domain controller over LDAP or LDAPS, using the connection settings of the source's Windows AD account, and lists the domain's users > 2. If **Discover local accounts** or **Discover account dependencies** is on, Infisical also lists the domain's Windows servers, and resolves each server's hostname through the domain controller's DNS > 3. Infisical connects to each server over WinRM to list its local accounts, the dependencies of the accounts it found, or both > > If Infisical can't reach a server over WinRM, the scan reports the server and continues with the others. ## Prerequisites * A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach your domain controller, and your Windows servers if you turn on **Discover local accounts** or **Discover account dependencies** * A [Windows AD account](https://infisical.com/docs/documentation/platform/pam/accounts/windows-ad.md) with a password, to sign in to the domain with * The [Product Admin role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#product-membership) in PAM * The Connector, Operator, or Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md#folder-and-account-memberships) on that Windows AD account To find local accounts or dependencies, you also need: * WinRM turned on for your Windows servers * A domain controller whose DNS resolves each server's hostname ## Step 1: Create a source **Step 1** Go to **Privileged Access Management** > **Discovery** and select **Add Source**. **Step 2** Select **Active Directory**, then select **Next**. **Step 3** Configure the source: | Field | Description | | - | - | | **Name** | A name for the source, such as `corp-active-directory` | | **Credential Account** | The Windows AD account to sign in to the domain with | | **Gateway** | The Gateway or Gateway pool to connect through | | **Scan Schedule** | **Manual**, **Daily**, or **Weekly** (see [scan schedules](https://infisical.com/docs/documentation/platform/pam/discovery/overview#scan-schedules)) | | **Discover local accounts** | Find the local accounts on the domain's Windows servers (on by default) | | **Discover account dependencies** | Find the services, scheduled tasks, and IIS application pools that run as the accounts the scan finds (off by default) | Infisical connects to the domain controller with the domain, address, ports, and LDAPS settings of the Windows AD account. **Step 4** If you turned on **Discover local accounts** or **Discover account dependencies**, configure how Infisical connects to your servers over WinRM: | Field | Description | | - | - | | **WinRM Port** | The WinRM port on each server (default `5985`) | | **Use HTTPS** | Connect to WinRM over HTTPS | | **Reject Unauthorized** | Check each server's TLS certificate (HTTPS only) | | **CA Certificate** | The PEM certificate of the private CA that issued the servers' WinRM certificates, if any | **Step 5** Select **Add Source**. ## Step 2: Run a scan On the **Discovery Sources** table, select the options menu on the source's row, then select **Scan Now**. A source can run one scan at a time. ## Step 3: Import accounts **Step 1** On the **Discovery Sources** table, select the source. **Step 2** On the **Staged Accounts** tab, select the accounts you want, then select **Import Accounts**. **Step 3** Select a **Destination Folder**, then a template for each account type in your selection (**Windows AD Template**, **Windows Template**, or both). **Step 4** To have Infisical set a new password on each account during the import, turn on **Rotate account passwords on import**. Then, for each account type in your selection, pick the [rotation account](https://infisical.com/docs/documentation/platform/pam/credential-rotation/overview.md#rotation-accounts) that Infisical signs in as to change the passwords: * **Windows AD Rotation Account:** an account in the same domain (by default, the source's credential account) * **Windows Rotation Account:** a local account, which can only rotate the local accounts on its own server If you leave a field empty, Infisical imports accounts of that type without a password. > [!WARNING] > > Rotation changes each account's password in Active Directory or on its server, so anything that signs in with the old password stops working. If the scan found the account's [dependencies](https://infisical.com/docs/documentation/platform/pam/credential-rotation/windows.md#dependencies), Infisical updates them with the new password. **Step 5** Select **Import**. **Step 6** Go to **Privileged Access Management** > **Accounts**. The scan doesn't read passwords, so each imported account that Infisical didn't rotate shows **Unavailable** until you set its password. For each of those accounts, open the options menu on its row, select **Configure**, and enter its password on the **Configuration** tab. > [!TIP] > > Your Active Directory accounts are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new accounts it finds. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.