> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Active Directory Discovery

> Scan an Active Directory environment for domain and local Windows accounts.

Active Directory discovery scans an AD environment to enumerate privileged accounts, stages them for review, and lets you import them into PAM. It finds two kinds of accounts:

| Discovered type | What it is                                      | When it is found                                                         |
| --------------- | ----------------------------------------------- | ------------------------------------------------------------------------ |
| **Windows AD**  | Domain user accounts from Active Directory      | Always                                                                   |
| **Windows**     | Local accounts on domain-joined Windows servers | Only when local account discovery is enabled and the server is reachable |

All scan traffic (LDAP, DNS, and WinRM) is tunneled through an Infisical [Gateway](/docs/documentation/platform/gateways/overview).

## How It Works

Behind the scenes, an Active Directory scan connects entirely through the Gateway:

1. **Domain accounts** are enumerated by querying the domain controller over LDAP (or LDAPS) using the credential account's connection settings.
2. **Windows servers** are located in the same LDAP query when local account discovery or dependency discovery is enabled.
3. Each server's hostname is resolved to an IP through the **domain controller's DNS**, so the Gateway can reach it.
4. Each reachable server is queried over **WinRM** to list its local users (local account discovery) and the services, scheduled tasks, and IIS application pools running as a discovered account (dependency discovery).

## Prerequisites

Before creating an Active Directory discovery source, make sure you have:

* A [Gateway](/docs/documentation/platform/gateways/overview) (or Gateway pool) with network access to your domain controller and, for local account discovery, to your Windows servers.
* A [Windows AD account](/docs/documentation/platform/pam/accounts/windows-ad) in PAM to use as the **credential account**. Discovery authenticates to your domain as this account. Its FQDN, DC address, ports, and LDAP/LDAPS settings define how the scan connects.
* The **Product Admin** role. See [Access Control](/docs/documentation/platform/pam/concepts/access-control).

<Note>
  To discover local Windows accounts or account dependencies, the credential account must include a **password**, WinRM must be enabled on your servers, and your domain controller's DNS must resolve each server's hostname so the Gateway can reach it.
</Note>

## Creating a Source

<Steps>
  <Step title="Start adding a source">
    Go to **Privileged Access Manager → Discovery** and click **Add Source**, then choose **Active Directory**.
  </Step>

  <Step title="Configure the source">
    | Field                  | Description                                                                                                |
    | ---------------------- | ---------------------------------------------------------------------------------------------------------- |
    | **Name**               | A descriptive name (e.g., `corp-active-directory`)                                                         |
    | **Credential Account** | The [Windows AD account](/docs/documentation/platform/pam/accounts/windows-ad) used to authenticate and scan    |
    | **Gateway**            | The [Gateway](/docs/documentation/platform/gateways/overview) or Gateway pool that scan traffic tunnels through |
    | **Scan Schedule**      | How often to scan automatically: **Manual**, **Daily**, or **Weekly**                                      |
  </Step>

  <Step title="Choose what to discover on your servers">
    Two options control what discovery does beyond enumerating domain accounts, and each can be turned on independently:

    | Option                            | Default | What it does                                                                                                                                                              |
    | --------------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | **Discover local accounts**       | On      | Enumerates local users on your Windows servers over WinRM                                                                                                                 |
    | **Discover account dependencies** | Off     | Detects the services, scheduled tasks, and IIS application pools that run as a discovered account (see [Dependencies](/docs/documentation/platform/pam/dependencies/overview)) |

    When either is on, discovery locates your Windows servers and connects to them over WinRM. See [Server WinRM Options](#server-winrm-options) for the connection settings.
  </Step>

  <Step title="Save">
    Click **Create**. The source appears in the Discovery table.
  </Step>
</Steps>

## Server WinRM Options

When **Discover local accounts** or **Discover account dependencies** is enabled, discovery locates domain-joined Windows servers, resolves each one through the domain controller's DNS, and connects to it over WinRM. Local account discovery enumerates the server's local users (staged as **Windows** accounts); dependency discovery enumerates the [dependencies](/docs/documentation/platform/pam/dependencies/overview) that run as a discovered account.

Both use the same WinRM connection options:

| Field                   | Description                                                              |
| ----------------------- | ------------------------------------------------------------------------ |
| **WinRM Port**          | Port used to reach WinRM on each server (default: 5985)                  |
| **Use HTTPS**           | Connect to WinRM over HTTPS                                              |
| **Reject Unauthorized** | Verify the server's TLS certificate (HTTPS only)                         |
| **CA Certificate**      | Optional PEM certificate, needed only when WinRM HTTPS uses a private CA |

<Note>
  If a scan cannot reach WinRM on a particular server, that server is skipped and the failure is reported on the run. The rest of the scan still completes.
</Note>

## Running a Scan

Trigger a scan manually with **Scan Now** from the source's row menu or its detail panel. Scans run in the background, and a source can only have one scan running at a time.

If the source is on a **Daily** or **Weekly** schedule, Infisical also scans it automatically when its interval has elapsed. **Manual** sources are only scanned when you trigger them.

## Importing Accounts

From the **Staged Accounts** tab, select the accounts you want and click **Import Accounts**. Then choose:

| Field                  | Description                                                                                                   |
| ---------------------- | ------------------------------------------------------------------------------------------------------------- |
| **Destination Folder** | The [folder](/docs/documentation/platform/pam/folders/overview) to import the accounts into                        |
| **Template**           | An [account template](/docs/documentation/platform/pam/templates/overview) for each account type in your selection |

Once imported, the accounts become regular PAM accounts in the chosen folder and inherit their template's rules.

<Warning>
  Imported accounts arrive without a credential because discovery finds accounts with a username but no password. Open each imported account and add a credential before connecting.
</Warning>

<Note>
  Enabling **Discover account dependencies** also connects to each Windows server over WinRM and records the services, scheduled tasks, and IIS application pools that run as a discovered account. These are stored as [dependencies](/docs/documentation/platform/pam/dependencies/overview) so they stay in sync when the account's password rotates. It is off by default and independent of **Discover local accounts**.
</Note>

## Next Steps

<CardGroup cols={2}>
  <Card title="Discovery Overview" icon="radar" href="/docs/documentation/platform/pam/discovery/overview">
    Understand staging, importing, and schedules.
  </Card>

  <Card title="Windows AD Accounts" icon="windows" href="/docs/documentation/platform/pam/accounts/windows-ad">
    Learn about the account type used to authenticate scans.
  </Card>

  <Card title="Account Dependencies" icon="diagram-project" href="/docs/documentation/platform/pam/dependencies/overview">
    Keep dependent services working across rotations.
  </Card>
</CardGroup>