docs/documentation/platform/pam/accounts/windows-ad.mdx
Windows AD accounts let you manage access to Windows servers using Active Directory domain credentials. Users connect through Web Access (a browser-based RDP client) or CLI (using your own RDP client) to any allowed host, and every session is recorded.
<Note> Windows AD accounts require session recordings to be stored in an external S3 bucket. Configure this in the [template](/documentation/platform/pam/templates/overview) before creating Windows AD accounts. </Note>1. Go to **Privileged Access Management → My Access**
2. Find the account and click **Launch**
3. If the account has multiple allowed hosts, select which host to connect to
4. Click **Connect in Browser**
5. A remote desktop session opens in a new tab
You get a full Windows desktop. To disconnect, log out or close the tab.
```bash
infisical pam access <folder>/<account>
```
If the account has multiple allowed hosts, use `--target` to specify which one:
```bash
infisical pam access <folder>/<account> --target <host>
```
The command prints the local port. Connect your RDP client to `localhost` on that port:
```bash
# Example using xfreerdp
xfreerdp /v:localhost:53306
```
<Tip>
The port is dynamically assigned. Use the `--port` flag if you need a specific port:
`infisical pam access <folder>/<account> --port 13389`
</Tip>
Press `Ctrl+C` to end the session and close the proxy.
Unlike single-server Windows accounts, Windows AD accounts can connect to multiple hosts. When you create the account, you define the list of allowed hosts. Users choose which host to connect to when launching a session.
This is useful for domain admin accounts that need access to multiple servers — you can manage a single account with one set of credentials while controlling which servers it can access.