AD Services Workload FAQ

This feature is currently available only to customers participating in a Private Preview. If you'd like to participate and be among the first to try this feature, ask our support or account team for details.

Before You Start

Does the Windows server need to be domain-joined?

No. The Active Directory Services Workload supports both domain-joined and non-domain-joined Windows servers. However, if you use Secure LDAP (Kerberos) on port 389, a non-domain-joined machine will fall back to NTLM authentication, which provides weaker security. Secure LDAP (TLS) on port 636 is recommended and works equally well on both.

Can I use an existing engine that is already running other workloads?

Yes. Multiple workloads can run on a single engine. When adding the engine in Settings > Engines, select Active Directory Services as an additional capability alongside any existing ones.

What permissions does the service account need?

At minimum, the service account needs read access to users and groups in Active Directory. For password reset and account unlock operations, the Reset Password permission is also required. For self-service password changes, the user's own Change Password permission is used.

Engine Setup

Can I add the engine to an existing site or do I need to create a new one?

You can add the engine to an existing site. When adding an engine, select an existing site from the Select option. Only create a new site if no suitable site exists for the network boundary where the engine will run.

How many engines do I need?

A minimum of one engine is required. For high availability and failover, two or more engines within the same site are recommended. If one engine goes offline, the platform will automatically route AD operations through the remaining engines in the site.

Registered Apps

Can one Registered App cover multiple domains?

No. Each Registered App is associated with a single domain FQDN. If you have multiple domains, create a separate Registered App for each one.

How do I update the service account secret after initial setup?

Navigate to Settings > Registered Apps, open the relevant Registered App, and update the Secret Name field with the new vaulted secret. Re-trigger validation after saving to confirm the new credentials are working correctly.

What is the difference between Secure LDAP (TLS) and Secure LDAP (Kerberos)?

Both modes encrypt communication between the engine and your domain controller, but they do so differently. Secure LDAP (TLS) uses SSL/TLS over port 636 and requires an X.509 certificate on the domain controller. This is recommended for all deployments and works on both domain-joined and non-domain-joined machines. Secure LDAP (Kerberos) uses Kerberos and SASL sealing over port 389 and does not require a certificate, but it requires a Windows engine and provides weaker security on non-domain-joined machines where it falls back to NTLM.

Testing

What should I do if login testing fails but validation passed?

Validation confirms that the engine can reach the domain controller and that the service account has the required permissions. A login failure after successful validation is most likely due to the user account being locked, disabled, or expired in Active Directory. Check the account status directly in AD and review the engine logs for authentication error details.

Do I need a specific test account for password operation testing?

It is recommended to use a dedicated test account in Active Directory for password operation testing. This avoids accidentally locking out or affecting real user accounts during testing. Ensure the test account is subject to the same domain password policies as your regular user accounts.

Is the failover test required if I only have one engine?

No. The failover test only applies if you have deployed two or more engines in the same site. If you are running a single engine, consider adding a second engine when high availability becomes a requirement.

Operations & Maintenance

How do I add a new domain after initial setup?

Navigate to Settings > Registered Apps and create a new Registered App for the additional domain. Follow the same steps as the initial domain configuration and select the appropriate site, choose your LDAP protocol, associate a vaulted secret, and trigger validation.

How do I change the site associated with a domain?

Open the Registered App for the domain in Settings > Registered Apps and update the Site field. Re-trigger validation after saving to confirm connectivity through the new site.

What happens to AD operations if my engine goes offline?

If multiple engines are deployed in the same site, the platform will automatically route AD operations through the remaining online engines. If only one engine is deployed and it goes offline, AD operations, including user authentication, lookups, and password operations, will be unavailable until the engine is back online. Read operations may be served from the directory cache for a period of time, but write operations such as password changes and account unlocks require a live connection to Active Directory.