Skip to main content
Active Directory discovery scans an AD environment to enumerate privileged accounts, stages them for review, and lets you import them into PAM. It finds two kinds of accounts: All scan traffic (LDAP, DNS, and WinRM) is tunneled through an Infisical Gateway.

​
How It Works

Behind the scenes, an Active Directory scan connects entirely through the Gateway:
  1. Domain accounts are enumerated by querying the domain controller over LDAP (or LDAPS) using the credential account’s connection settings.
  2. Windows servers are located in the same LDAP query when local account discovery or dependency discovery is enabled.
  3. Each server’s hostname is resolved to an IP through the domain controller’s DNS, so the Gateway can reach it.
  4. Each reachable server is queried over WinRM to list its local users (local account discovery) and the services, scheduled tasks, and IIS application pools running as a discovered account (dependency discovery).

​
Prerequisites

Before creating an Active Directory discovery source, make sure you have:
  • A Gateway (or Gateway pool) with network access to your domain controller and, for local account discovery, to your Windows servers.
  • A Windows AD account in PAM to use as the credential account. Discovery authenticates to your domain as this account. Its FQDN, DC address, ports, and LDAP/LDAPS settings define how the scan connects.
  • The Product Admin role. See Access Control.
To discover local Windows accounts or account dependencies, the credential account must include a password, WinRM must be enabled on your servers, and your domain controller’s DNS must resolve each server’s hostname so the Gateway can reach it.

​
Creating a Source

1

Start adding a source

Go to Privileged Access Manager → Discovery and click Add Source, then choose Active Directory.
2

Configure the source

3

Choose what to discover on your servers

Two options control what discovery does beyond enumerating domain accounts, and each can be turned on independently:When either is on, discovery locates your Windows servers and connects to them over WinRM. See Server WinRM Options for the connection settings.
4

Save

Click Create. The source appears in the Discovery table.

​
Server WinRM Options

When Discover local accounts or Discover account dependencies is enabled, discovery locates domain-joined Windows servers, resolves each one through the domain controller’s DNS, and connects to it over WinRM. Local account discovery enumerates the server’s local users (staged as Windows accounts); dependency discovery enumerates the dependencies that run as a discovered account. Both use the same WinRM connection options:
If a scan cannot reach WinRM on a particular server, that server is skipped and the failure is reported on the run. The rest of the scan still completes.

​
Running a Scan

Trigger a scan manually with Scan Now from the source’s row menu or its detail panel. Scans run in the background, and a source can only have one scan running at a time. If the source is on a Daily or Weekly schedule, Infisical also scans it automatically when its interval has elapsed. Manual sources are only scanned when you trigger them.

​
Importing Accounts

From the Staged Accounts tab, select the accounts you want and click Import Accounts. Then choose: Once imported, the accounts become regular PAM accounts in the chosen folder and inherit their template’s rules.
Imported accounts arrive without a credential because discovery finds accounts with a username but no password. Open each imported account and add a credential before connecting.
Enabling Discover account dependencies also connects to each Windows server over WinRM and records the services, scheduled tasks, and IIS application pools that run as a discovered account. These are stored as dependencies so they stay in sync when the account’s password rotates. It is off by default and independent of Discover local accounts.

​
Next Steps

Discovery Overview

Understand staging, importing, and schedules.

Windows AD Accounts

Learn about the account type used to authenticate scans.

Account Dependencies

Keep dependent services working across rotations.