docs/documentation/platform/pam/dependencies/overview.mdx
A dependency is a Windows service, scheduled task, or IIS application pool that runs as one of your accounts and therefore stores a copy of that account's password. When the account's password rotates, every dependency still holding the old password would fail to start until it is updated.
Infisical detects these dependencies during discovery and syncs them automatically during rotation, so rotating a Windows account does not break the services that depend on it.
<Note> Dependencies apply to Windows accounts only: [Windows AD](/documentation/platform/pam/accounts/windows-ad) (domain) and [Windows](/documentation/platform/pam/accounts/windows) (local). </Note>| Type | What it is |
|---|---|
| Windows service | A service whose Log On As identity is the account |
| Scheduled task | A task configured to run under the account with a stored password |
| IIS application pool | An app pool whose process model runs as the account |
Dependencies are detected during Active Directory discovery when the Discover account dependencies option is enabled on the source. This option is off by default. When enabled, discovery locates the domain-joined Windows servers, connects to each over WinRM through the Gateway, and enumerates the services, scheduled tasks, and IIS application pools that run under a discovered account.
Each detected dependency is anchored to the stable identity of the account it runs as, so it is linked to the correct managed account once that account is imported. Re-running a scan updates the dependency list in place rather than creating duplicates, and a dependency that is no longer found on a re-scanned machine is removed.
<Note> **Discover account dependencies** is independent of **Discover local accounts**, so you can enable either or both. Both reach your servers over WinRM, so the source's WinRM settings (port, HTTPS, and CA certificate) apply to dependency detection as well. Dependencies are detected from the servers within the source's scan scope. </Note>You can review an account's detected dependencies on the account's Rotation tab, grouped by machine, along with the last sync status of each.
When a Windows account's password rotates, Infisical pushes the new password to each of the account's dependencies so they continue to authenticate:
<Steps> <Step title="Connect to each dependency's machine"> Using the account's rotation account, Infisical connects over WinRM to the machine each dependency runs on. For domain accounts, machine hostnames are re-resolved through the domain controller's DNS at sync time so a stale address cannot target the wrong host. </Step> <Step title="Update the stored credential"> The new password is written to the dependency:| Type | What happens |
|------|--------------|
| **Windows service** | The service's stored password is updated, and the service is restarted if it was running |
| **Scheduled task** | The task is reconfigured with the new password |
| **IIS application pool** | The app pool's process-model password is updated, and the pool is recycled if it was started |
Dependency sync runs as part of rotation and is best effort: a failure on one dependency is recorded on that dependency's row and never fails the account rotation. Each dependency shows one of:
| Status | Meaning |
|---|---|
| Rotated | The new password was applied successfully on the last rotation |
| Failed | The last sync did not complete; the recorded error explains why |
| Never | The dependency has not been through a rotation yet |