docs/documentation/platform/pam/discovery/active-directory.mdx
Active Directory discovery scans an AD environment to enumerate privileged accounts, stages them for review, and lets you import them into PAM. It finds two kinds of accounts:
| Discovered type | What it is | When it is found |
|---|---|---|
| Windows AD | Domain user accounts from Active Directory | Always |
| Windows | Local accounts on domain-joined Windows servers | Only when local account discovery is enabled and the server is reachable |
All scan traffic (LDAP, DNS, and WinRM) is tunneled through an Infisical Gateway.
Behind the scenes, an Active Directory scan connects entirely through the Gateway:
Before creating an Active Directory discovery source, make sure you have:
| Option | Default | What it does |
|--------|---------|--------------|
| **Discover local accounts** | On | Enumerates local users on your Windows servers over WinRM |
| **Discover account dependencies** | Off | Detects the services, scheduled tasks, and IIS application pools that run as a discovered account (see [Dependencies](/documentation/platform/pam/dependencies/overview)) |
When either is on, discovery locates your Windows servers and connects to them over WinRM. See [Server WinRM Options](#server-winrm-options) for the connection settings.
When Discover local accounts or Discover account dependencies is enabled, discovery locates domain-joined Windows servers, resolves each one through the domain controller's DNS, and connects to it over WinRM. Local account discovery enumerates the server's local users (staged as Windows accounts); dependency discovery enumerates the dependencies that run as a discovered account.
Both use the same WinRM connection options:
| Field | Description |
|---|---|
| WinRM Port | Port used to reach WinRM on each server (default: 5985) |
| Use HTTPS | Connect to WinRM over HTTPS |
| Reject Unauthorized | Verify the server's TLS certificate (HTTPS only) |
| CA Certificate | Optional PEM certificate, needed only when WinRM HTTPS uses a private CA |
Trigger a scan manually with Scan Now from the source's row menu or its detail panel. Scans run in the background, and a source can only have one scan running at a time.
If the source is on a Daily or Weekly schedule, Infisical also scans it automatically when its interval has elapsed. Manual sources are only scanned when you trigger them.
From the Staged Accounts tab, select the accounts you want and click Import Accounts. Then choose:
| Field | Description |
|---|---|
| Destination Folder | The folder to import the accounts into |
| Template | An account template for each account type in your selection |
Once imported, the accounts become regular PAM accounts in the chosen folder and inherit their template's rules.
<Warning> Imported accounts arrive without a credential because discovery finds accounts with a username but no password. Open each imported account and add a credential before connecting. </Warning> <Note> Enabling **Discover account dependencies** also connects to each Windows server over WinRM and records the services, scheduled tasks, and IIS application pools that run as a discovered account. These are stored as [dependencies](/documentation/platform/pam/dependencies/overview) so they stay in sync when the account's password rotates. It is off by default and independent of **Discover local accounts**. </Note>