Account Dependencies

A dependency is a Windows service, scheduled task, or IIS application pool that runs as one of your accounts and therefore stores a copy of that account’s password. When the account’s password rotates, every dependency still holding the old password would fail to start until it is updated. Infisical detects these dependencies during discovery and syncs them automatically during rotation, so rotating a Windows account does not break the services that depend on it.

Dependencies apply to Windows accounts only: Windows AD (domain) and Windows (local).

Detected dependency types

Type	What it is
Windows service	A service whose Log On As identity is the account
Scheduled task	A task configured to run under the account with a stored password
IIS application pool	An app pool whose process model runs as the account

Detection

Dependencies are detected during Active Directory discovery when the Discover account dependencies option is enabled on the source. This option is off by default. When enabled, discovery locates the domain-joined Windows servers, connects to each over WinRM through the Gateway, and enumerates the services, scheduled tasks, and IIS application pools that run under a discovered account. Each detected dependency is anchored to the stable identity of the account it runs as, so it is linked to the correct managed account once that account is imported. Re-running a scan updates the dependency list in place rather than creating duplicates, and a dependency that is no longer found on a re-scanned machine is removed.

Discover account dependencies is independent of Discover local accounts, so you can enable either or both. Both reach your servers over WinRM, so the source’s WinRM settings (port, HTTPS, and CA certificate) apply to dependency detection as well. Dependencies are detected from the servers within the source’s scan scope.

You can review an account’s detected dependencies on the account’s Rotation tab, grouped by machine, along with the last sync status of each.

Rotation (sync)

When a Windows account’s password rotates, Infisical pushes the new password to each of the account’s dependencies so they continue to authenticate:

Connect to each dependency's machine

Using the account’s rotation account, Infisical connects over WinRM to the machine each dependency runs on. For domain accounts, machine hostnames are re-resolved through the domain controller’s DNS at sync time so a stale address cannot target the wrong host.

Update the stored credential

The new password is written to the dependency:

Type	What happens
Windows service	The service’s stored password is updated, and the service is restarted if it was running
Scheduled task	The task is reconfigured with the new password
IIS application pool	The app pool’s process-model password is updated, and the pool is recycled if it was started

Dependency sync runs as part of rotation and is best effort: a failure on one dependency is recorded on that dependency’s row and never fails the account rotation. Each dependency shows one of:

Status	Meaning
Rotated	The new password was applied successfully on the last rotation
Failed	The last sync did not complete; the recorded error explains why
Never	The dependency has not been through a rotation yet

Because sync keeps dependent services working, dependencies detected on the scanned servers are included automatically. Make sure the servers within a discovery source’s scan scope are ones you trust to run as your managed accounts.

Privileged Access Manager

Product Reference

Account Dependencies

Detected dependency types

Detection

Rotation (sync)

Next Steps

Active Directory Discovery

Windows Credential Rotation

​Detected dependency types

​Detection

​Rotation (sync)

​Next Steps

Active Directory Discovery

Windows Credential Rotation

Detected dependency types

Detection

Rotation (sync)

Next Steps