Skip to main content
Active Directory discovery scans an AD environment to enumerate privileged accounts, stages them for review, and lets you import them into PAM. It finds two kinds of accounts: All scan traffic (LDAP, DNS, and WinRM) is tunneled through an Infisical Gateway.

​
How It Works

Behind the scenes, an Active Directory scan connects entirely through the Gateway:
  1. Domain accounts are enumerated by querying the domain controller over LDAP (or LDAPS) using the credential account’s connection settings.
  2. Windows servers are located in the same LDAP query when local account discovery is enabled.
  3. Each server’s hostname is resolved to an IP through the domain controller’s DNS, so the Gateway can reach it.
  4. Each reachable server is queried over WinRM to list its local users.

​
Prerequisites

Before creating an Active Directory discovery source, make sure you have:
  • A Gateway (or Gateway pool) with network access to your domain controller and, for local account discovery, to your Windows servers.
  • A Windows AD account in PAM to use as the credential account. Discovery authenticates to your domain as this account. Its FQDN, DC address, ports, and LDAP/LDAPS settings define how the scan connects.
  • The Product Admin role. See Access Control.
To discover local Windows accounts, the credential account must include a password, WinRM must be enabled on your servers, and your domain controller’s DNS must resolve each server’s hostname so the Gateway can reach it.

​
Creating a Source

1

Start adding a source

Go to Privileged Access Manager → Discovery and click Add Source, then choose Active Directory.
2

Configure the source

3

Configure local account discovery

Leave Discover local accounts on to enumerate local users on your Windows servers over WinRM, or turn it off to discover domain accounts only. See Local Account Discovery for the WinRM options.
4

Save

Click Create. The source appears in the Discovery table.

​
Local Account Discovery

When Discover local accounts is enabled, discovery locates domain-joined Windows servers, resolves each one through the domain controller’s DNS, and queries it over WinRM to enumerate local users. These become Windows (local) staged accounts. The following WinRM options are available:
If a scan cannot reach WinRM on a particular server, that server is skipped and the failure is reported on the run. The rest of the scan still completes.

​
Running a Scan

Trigger a scan manually with Scan Now from the source’s row menu or its detail panel. Scans run in the background, and a source can only have one scan running at a time. If the source is on a Daily or Weekly schedule, Infisical also scans it automatically when its interval has elapsed. Manual sources are only scanned when you trigger them.

​
Importing Accounts

From the Staged Accounts tab, select the accounts you want and click Import Accounts. Then choose: Once imported, the accounts become regular PAM accounts in the chosen folder and inherit their template’s rules.
Imported accounts arrive without a credential because discovery finds accounts with a username but no password. Open each imported account and add a credential before connecting.

​
Next Steps

Discovery Overview

Understand staging, importing, and schedules.

Windows AD Accounts

Learn about the account type used to authenticate scans.