🏢 Windows Domain Account

A Windows domain account in its simplest form: the domain, the username and the password.

• For new Active Directory accounts, prefer Active Directory Account, which also sets the NetBIOS name, the logon format and the UPN suffix.

Type id: type-windows-domain. Agents and sneakers-put name the type by this id; sneakers_list_secret_types lists it.

🧾 Fields

Field	Key	Kind	Required	Secret	Notes
Domain	domain	Text	Yes	No
Username	username	Text	Yes	No
Password	password	Password (can be generated)	Yes	Sensitive	the field rotation changes

🔒 What's secret

Password is masked until someone who can read the secret reveals or copies it, and every reveal and copy is written to the audit trail. Everything else is plain metadata that anyone who can see the folder can see.

🔁 Heartbeat, rotation and check-out

• Heartbeat: yes, against the secret's target (how it works).

• Rotation: yes: rotation changes Password (how it works).

• Check-out: yes: one person at a time holds it for a lease (check-out).

• The heartbeat binds to the directory as the account itself. Rotation is a self-service password change made with the current password, so the connector needs no admin rights on the directory. When the target has a Kerberos realm, the new password is then proved over Kerberos, on the connection's KDC port.

• The domain's built-in Administrator (RID 500) is never rotated; its heartbeat still runs.

🎯 Targets

A target with an LDAPS connection (LDAP over TLS, port 636), an LDAP connection, or a Kerberos connection (the password changes over kpasswd on port 464 of the same host). Active Directory only allows a password change over an encrypted connection, so use LDAPS or Kerberos to rotate. See targets and connections for how to set one up.