Skip to main content
This page covers what’s specific to rotating the password of a Windows account (a local account) or a Windows AD account (a domain account). To turn on rotation and set a rotation account, see Credential rotation. Infisical changes Windows passwords over WinRM through a Gateway. The WinRM port, HTTPS setting, and CA certificate come from the account’s connection details. When a Windows account rotates, Infisical also updates the services, scheduled tasks, and IIS application pools that run as the account. See Dependencies.

​
Prerequisites

  • A Gateway that can reach the account’s host (for a local account) or domain controller (for a domain account)
  • WinRM turned on and reachable on that host or domain controller
If the network between the Gateway and the host isn’t trusted, turn on WinRM over HTTPS on the account. Over HTTP, WinRM protects the connection only with NTLM message encryption.

​
Rotation account

For the rotation account, use a local administrator on the same host. A local administrator can reset the password and check the new one on the host.The account can also change its own password, but only if it can sign in over WinRM and has the right to change its own password. Many local accounts can’t, so use a local administrator where you can.

​
How the password is changed

Infisical connects to the account’s host over WinRM as the rotation account and runs:

​
Dependencies

A dependency is a Windows service, scheduled task, or IIS application pool that runs as the account and stores a copy of the account’s password. When the account rotates, Infisical connects over WinRM to each dependency’s server as the rotation account and updates the dependency with the new password, so the dependency doesn’t fail with the old one:

​
Find an account’s dependencies

Infisical finds dependencies when it scans an Active Directory discovery source that has Discover account dependencies turned on. This option is off by default. During the scan, Infisical connects over WinRM to each domain-joined Windows server in the source’s scope and lists the services, scheduled tasks, and IIS application pools that run as an account it found. When you import an account, Infisical links the account’s dependencies to the imported PAM account. Each scan updates the list. If a scan no longer finds a dependency on a server, Infisical removes the dependency. Infisical updates every dependency it finds on the scanned servers when the account rotates, so only include servers you trust in the discovery source’s scope. To see an account’s dependencies, go to Privileged Access Management > Accounts, open the options menu on the account’s row, select Configure, and open the Rotation tab.

​
Check whether a dependency updated

If Infisical can’t update a dependency, the account’s rotation still succeeds. The Rotation Status column on the Rotation tab shows the result for each dependency: