docs/documentation/platform/secret-rotation/windows-local-account.mdx
This rotation updates a single credential set in place. Old credentials become invalid immediately upon rotation. This means that clients using the previous credentials will fail to authenticate until they retrieve the new credentials.
This is a limitation of the rotation mechanism and cannot be rectified by Infisical. </Note>
```powershell
New-NetFirewallRule -DisplayName "Allow SMB Inbound" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Allow
```
To verify the rule was created:
```powershell
Get-NetFirewallRule -DisplayName "Allow SMB Inbound"
```
2. Select the **Windows Local Account** option.
3. Select the **SMB Connection** to use and configure the rotation behavior. Then click **Next**.
- **SMB Connection** - the connection that will perform the rotation of the configured user's password.
- **Rotation Interval** - the interval, in days, that once elapsed will trigger a rotation.
- **Rotate At** - the local time of day when rotation should occur once the interval has elapsed.
- **Auto-Rotation Enabled** - whether secrets should automatically be rotated once the rotation interval has elapsed. Disable this option to manually rotate secrets or pause secret rotation.
<Note>
Due to Windows Local Account Rotations rotating a single credential set, auto-rotation may result in service interruptions. If you need to ensure service continuity, we recommend disabling this option.
</Note>
4. Configure the required Parameters for your rotation. Then click **Next**.
- **Rotation Method** - The method to use when rotating the target user's password.
- **Login as Target** - Infisical will use the target user's current credentials to authenticate and rotate its own password. See the [Login as Target Requirements](#login-as-target-requirements) section below for important configuration details.
- **Login as Root** - Infisical will use the administrator credentials provided in the SMB Connection to rotate the target user's password. This is the recommended method for most use cases.
- **Username** - The target Windows username whose password will be rotated.
- **Current Password** - The current password of the target user (required when **Rotation Method** is set to **Login as Target**).
- **Password Requirements** - The constraints to apply when generating new passwords.
5. Specify the secret names that the Windows credentials should be mapped to. Then click **Next**.
- **Username** - the name of the secret that the Windows username will be stored in.
- **Password** - the name of the secret that the rotated password will be stored in.
6. Give your rotation a name and description (optional). Then click **Next**.
- **Name** - the name of the secret rotation configuration. Must be slug-friendly.
- **Description** (optional) - a description of this rotation configuration.
7. Review your configuration, then click **Create Secret Rotation**.
8. Your **Windows Local Account** credentials are now available for use via the mapped secrets.
### Login as Target Requirements
The **Login as Target** method allows a user to rotate their own password without requiring separate administrator credentials in the SMB Connection. However, this method has specific requirements due to Windows security restrictions:
1. **Local Administrator Privileges** - The target user must be a member of the local `Administrators` group on the Windows machine.
2. **Disable Remote UAC Token Filtering** - By default, Windows filters administrative tokens for remote connections, even for local administrators. You must disable this by setting the following registry key on the target Windows server:
```powershell
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "LocalAccountTokenFilterPolicy" -Value 1 -Type DWord
```
After setting this, restart the server or the LanmanServer service:
```powershell
Restart-Service LanmanServer
```
<Warning>
Disabling Remote UAC token filtering reduces security by allowing remote connections with full administrative privileges. Only enable this setting if you understand the security implications and have other compensating controls in place (e.g., network segmentation, firewall rules).
</Warning>
<Note>
If you cannot or prefer not to disable Remote UAC token filtering, use the **Login as Root** method instead, which uses domain administrator or built-in Administrator credentials from the SMB Connection.
</Note>
### Reconcile Windows Local Account
If you suspect the credentials are out of sync (for example, after a manual password change on the server), you can regain access by using **Reconcile**. This will use the configured Windows App Connection's administrator account to reset the target user's password and sync it with Infisical.
</Tab>
<Tab title="API">
To create a Windows Local Account Rotation, make an API request to the [Create Windows
Local Account Rotation](/api-reference/endpoints/secret-rotations/windows-local-account/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://us.infisical.com/api/v2/secret-rotations/windows-local-account \
--header 'Content-Type: application/json' \
--data '{
"name": "my-windows-rotation",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "my windows local account rotation",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "dev",
"secretPath": "/",
"isAutoRotationEnabled": false,
"rotationInterval": 30,
"rotateAtUtc": {
"hours": 0,
"minutes": 0
},
"parameters": {
"rotationMethod": "login-as-root",
"username": "appuser",
"passwordRequirements": {
"length": 48,
"required": {
"digits": 2,
"lowercase": 2,
"uppercase": 2,
"symbols": 2
},
"allowedSymbols": "-_.~!*"
}
},
"secretsMapping": {
"username": "WINDOWS_USERNAME",
"password": "WINDOWS_PASSWORD"
}
}'
```
### Sample response
```bash Response
{
"secretRotation": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-windows-rotation",
"description": "my windows local account rotation",
"secretsMapping": {
"username": "WINDOWS_USERNAME",
"password": "WINDOWS_PASSWORD"
},
"isAutoRotationEnabled": false,
"activeIndex": 0,
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"rotationInterval": 30,
"rotationStatus": "success",
"lastRotationAttemptedAt": "2023-11-07T05:31:56Z",
"lastRotatedAt": "2023-11-07T05:31:56Z",
"lastRotationJobId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"nextRotationAt": "2023-11-07T05:31:56Z",
"connection": {
"app": "smb",
"name": "my-windows-connection",
"description": "SMB connection",
"credentials": {}
},
"folder": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "dev",
"path": "/"
},
"environment": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "Development",
"slug": "dev"
},
"parameters": {
"username": "appuser",
"rotationMethod": "login-as-root",
"passwordRequirements": {
"length": 48,
"required": {
"digits": 2,
"lowercase": 2,
"uppercase": 2,
"symbols": 2
},
"allowedSymbols": "-_.~!*"
}
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"rotateAtUtc": {
"hours": 0,
"minutes": 0
},
"secrets": [],
"type": "windows-local-account"
}
}
```
</Tab>