Skip to main content
A Windows AD account lets people open a remote desktop (RDP) session as an Active Directory domain account without seeing its password. One account can sign in to several servers, and you choose which ones in the account’s list of allowed hosts. People connect with an RDP client in the browser or with their own RDP client through the Infisical CLI, and Infisical records each session. To sign in to one server with a local Windows account, use a Windows account instead.
Windows AD accounts are available under Infisical’s Enterprise plan.

​
Prerequisites

  • The Admin role on the folder you’ll add the account to
  • A Gateway that can reach each allowed host on its RDP port
  • A Windows AD template that stores recordings in your own S3 bucket (the default Windows AD template stores them in Infisical’s database, so a Product Admin must change it or create another template)

​
Create an account

1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder to add the account to and a Windows AD Account Template, then select Next.
3
Enter a Name for the account and the domain’s connection details:Infisical uses the domain controller and WinRM settings for credential rotation, credential health checks, and dependency detection, not for RDP sessions.
4
Enter the Username in DOMAIN\username format, such as CORP\Administrator, and the Password.
5
Select Create.

​
Connect

People can open a remote desktop in the browser or connect through the CLI. To learn how to launch a session, see Connect to an account. If the account has more than one allowed host, select the Host to connect to when you launch the session. In the CLI, pass the host with --target:
The CLI starts a local proxy and prints its port. Point your RDP client at localhost on that port, for example:
Press Ctrl+C to end the session.