🖥️ Windows Account (Local)
A local account on one Windows machine: the machine, the username and the password.
Type id: type-windows-local. Agents and sneakers-put name the type by this id; sneakers_list_secret_types lists it.
🧾 Fields
| Field | Key | Kind | Required | Secret | Notes |
|---|---|---|---|---|---|
| Description | description | Multi-line text | No | No | |
| Machine | machine | Text | Yes | No | |
| Username | username | Text | Yes | No | |
| Password | password | Password (can be generated) | Yes | Sensitive | the field rotation changes |
| Notes | notes | Multi-line text | No | No |
🔒 What's secret
Password is masked until someone who can read the secret reveals or copies it, and every reveal and copy is written to the audit trail. Everything else is plain metadata that anyone who can see the folder can see.
🔁 Heartbeat, rotation and check-out
-
Heartbeat: yes, against the secret's target (how it works).
-
Rotation: yes: rotation changes Password (how it works).
-
Check-out: yes: one person at a time holds it for a lease (check-out).
-
The type is marked for heartbeat, rotation and check-out, but they need a WinRM or SAMR connection, and neither adapter is built yet: a heartbeat or rotation over them reports the target as unreachable.
🎯 Targets
A target with a WinRM connection (port 5986 over TLS by default). The connection can be saved today; checking and rotating over it aren't built yet. See targets and connections for how to set one up.