Skip to main content
Active Directory discovery finds the users in an Active Directory domain, and optionally the local accounts on its Windows servers, so you can import them into PAM. For how discovery works across every source type, see Discovery. A scan finds two types of account: The scan can also find the dependencies of the accounts it finds, which are the services, scheduled tasks, and IIS application pools that run as them. Infisical connects to the domain controller and the servers through a Gateway, signed in as a Windows AD account that you choose for the source.
  1. Infisical connects to the domain controller over LDAP or LDAPS, using the connection settings of the source’s Windows AD account, and lists the domain’s users
  2. If Discover local accounts or Discover account dependencies is on, Infisical also lists the domain’s Windows servers, and resolves each server’s hostname through the domain controller’s DNS
  3. Infisical connects to each server over WinRM to list its local accounts, the dependencies of the accounts it found, or both
If Infisical can’t reach a server over WinRM, the scan reports the server and continues with the others.

​
Prerequisites

  • A Gateway that can reach your domain controller, and your Windows servers if you turn on Discover local accounts or Discover account dependencies
  • A Windows AD account with a password, to sign in to the domain with
  • The Product Admin role in PAM
  • The Connector, Operator, or Admin role on that Windows AD account
To find local accounts or dependencies, you also need:
  • WinRM turned on for your Windows servers
  • A domain controller whose DNS resolves each server’s hostname

​
Step 1: Create a source

1
Go to Privileged Access Management > Discovery and select Add Source.
2
Select Active Directory, then select Next.
3
Configure the source:Infisical connects to the domain controller with the domain, address, ports, and LDAPS settings of the Windows AD account.
4
If you turned on Discover local accounts or Discover account dependencies, configure how Infisical connects to your servers over WinRM:
5
Select Add Source.

​
Step 2: Run a scan

On the Discovery Sources table, select the options menu on the source’s row, then select Scan Now. A source can run one scan at a time.

​
Step 3: Import accounts

1
On the Discovery Sources table, select the source.
2
On the Staged Accounts tab, select the accounts you want, then select Import Accounts.
3
Select a Destination Folder, then a template for each account type in your selection (Windows AD Template, Windows Template, or both), and select Import.
4
Go to Privileged Access Management > Accounts. For each imported account, open the options menu on its row, select Configure, and enter its password on the Configuration tab. The scan doesn’t read passwords, so you can’t connect to an imported account until you enter its password.
Your Active Directory accounts are in PAM. Anyone with access to the destination folder can launch sessions on them, and each scan of the source stages any new accounts it finds.