This page covers what is specific to rotating a Windows account (local) or a Windows AD account (domain). For how rotation is configured and scheduled, see the overview.
Windows rotation runs over WinRM, tunneled through an Infisical Gateway. The account’s WinRM settings (port, HTTPS, and CA certificate) come from its connection details.
How the password is changed
Windows (local)
Windows AD (domain)
The rotation account connects to the account’s host over WinRM and resets the local user’s password: The rotation account connects to the domain controller (the account’s DC address) over WinRM and resets the domain account’s password: Rotation account requirements
Windows (local)
Windows AD (domain)
- Self-rotation: the account changes its own password. This requires the account to be able to sign in over WinRM and to hold the rights to change its own credential. Many local accounts cannot, so delegated rotation is the common choice.
- Delegated rotation: a local administrator on the same host performs the change. This is the recommended setup for local accounts, because the administrator can both reset the password and verify it on the box.
A delegated rotation account must connect to the same host as the account it rotates.Domain accounts use delegated rotation: a separate domain account with permission to reset the target account’s password (for example, an account with delegated control over the target’s OU, or a suitable administrative account).The rotation account must be a different directory identity than the account it rotates. An account cannot reset its own domain password this way, and Infisical rejects a rotation account that resolves to the same directory object as the target.A delegated rotation account must belong to the same domain as the account it rotates, since the reset runs against that domain’s controller.
Prerequisites
- A Gateway (or Gateway pool) with network access to the target host (local accounts) or the domain controller (domain accounts).
- WinRM enabled and reachable on the host or domain controller the rotation connects to.
- A rotation account configured on the account, as described above.
For an untrusted Gateway-to-host network segment, enable WinRM over HTTPS on the account so the connection is protected by TLS. Over plain HTTP, WinRM relies on NTLM message sealing.
Dependencies
Rotating a Windows account also updates the services, scheduled tasks, and IIS application pools that run as that account, so they keep working with the new password. See Account Dependencies for how dependencies are detected and synced. 
