> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/configuration-center/ad-configurations.md). # AD Configurations This section allows you to configure Active Directory connection and authentication settings. Use this configuration to securely connect to and scan Active Directory environments. A saved configuration is selected in the **Active Directory Configuration** field when you start a new scan. ### Active Directory Configurations List Open **Configuration Center > Active Directory > Manage**. The **Active Directory Configurations (N)** table lists every saved configuration with the following columns: * **Forest** * **Domain Controller IP Address** * **Authentication Type**: `Domain` or `CyberArk`. * **Username**: empty for CyberArk configurations. * **Last Used**: the last time a scan used the configuration, or `—` if it has never been used. Click **New Configuration** to create a configuration. Click a forest name, or use **Edit** in the three-dot menu, to open an existing configuration. **Delete** in the three-dot menu removes it after confirmation (**Confirm Delete Operation** > **Delete Configuration**).
Active Directory Configurations list

Active Directory Configurations list

Active Directory Configuration form
### Fields **Forest**: The Fully Qualified Domain Name (FQDN) of the forest that is going to be analyzed. The submitted FQDN is analyzed automatically, and the parent and child domains/forests in the Active Directory environment are included in this new scan. **Domain Controller IP Address**: IP Address of the domain controller that belongs to the submitted forest. If the related domain or forest contains more than one domain controller, any domain controller IP address which is accessible over the network from the Forestall machine is accepted. **Auth Type**: How the credentials are provided. See [Auth Type](#auth-type) below. **Username**: Name of the user account that is created for scanning the environment during the Forestall Requirements and Installation phase. As this user requires specific permissions and settings, if you are unsure whether it satisfies these prerequisites, please check the Requirements and Installation document. Shown only when **Auth Type** is `Domain`. **Password**: Password that belongs to the submitted username. Shown only when **Auth Type** is `Domain`. ### Auth Type The **Auth Type** field determines how the Active Directory credentials are provided. Two options are available: * **Domain** (default): enter the **Username** and **Password** of the scan account directly in the form. * **CyberArk**: the credentials are retrieved from CyberArk at scan time using the selected **CyberArk Configuration**. The **Username** and **Password** fields are hidden.
Auth Type options
When **CyberArk** is selected, select an existing **CyberArk Configuration** from the drop-down list.
CyberArk Configuration drop-down
If no CyberArk configuration exists yet, the drop-down list shows **No configurations yet** and is disabled. Click the **+** button next to the drop-down list to create a new CyberArk Configuration without leaving the page. The **Create CyberArk Configuration** window has the same fields as the [CyberArk](/forestall/configuration-center/cyberark.md) page.
Create CyberArk Configuration window
After the configuration is successfully verified and saved, it becomes available for selection in the **CyberArk Configuration** drop-down list. ### Buttons * **Test**: tests the connection to the domain controller with the values in the form, without saving them. * **Save**: saves the configuration. * **Delete**: shown only when editing an existing configuration. Removes it after confirmation.