AD Configurations

This section allows you to configure Active Directory connection and authentication settings. Use this configuration to securely connect to and scan Active Directory environments. A saved configuration is selected in the Active Directory Configuration field when you start a new scan.

Active Directory Configurations List

Open Configuration Center > Active Directory > Manage. The Active Directory Configurations (N) table lists every saved configuration with the following columns:

• Forest

• Domain Controller IP Address

• Authentication Type: Domain or CyberArk.

• Username: empty for CyberArk configurations.

• Last Used: the last time a scan used the configuration, or — if it has never been used.

Click New Configuration to create a configuration. Click a forest name, or use Edit in the three-dot menu, to open an existing configuration. Delete in the three-dot menu removes it after confirmation (Confirm Delete Operation > Delete Configuration).

Active Directory Configurations list

Fields

Forest: The Fully Qualified Domain Name (FQDN) of the forest that is going to be analyzed. The submitted FQDN is analyzed automatically, and the parent and child domains/forests in the Active Directory environment are included in this new scan.

Domain Controller IP Address: IP Address of the domain controller that belongs to the submitted forest. If the related domain or forest contains more than one domain controller, any domain controller IP address which is accessible over the network from the Forestall machine is accepted.

Auth Type: How the credentials are provided. See Auth Type below.

Username: Name of the user account that is created for scanning the environment during the Forestall Requirements and Installation phase. As this user requires specific permissions and settings, if you are unsure whether it satisfies these prerequisites, please check the Requirements and Installation document. Shown only when Auth Type is Domain.

Password: Password that belongs to the submitted username. Shown only when Auth Type is Domain.

Auth Type

The Auth Type field determines how the Active Directory credentials are provided. Two options are available:

• Domain (default): enter the Username and Password of the scan account directly in the form.

• CyberArk: the credentials are retrieved from CyberArk at scan time using the selected CyberArk Configuration. The Username and Password fields are hidden.

When CyberArk is selected, select an existing CyberArk Configuration from the drop-down list.

If no CyberArk configuration exists yet, the drop-down list shows No configurations yet and is disabled. Click the + button next to the drop-down list to create a new CyberArk Configuration without leaving the page. The Create CyberArk Configuration window has the same fields as the CyberArk page.

After the configuration is successfully verified and saved, it becomes available for selection in the CyberArk Configuration drop-down list.

Buttons

• Test: tests the connection to the domain controller with the values in the form, without saving them.

• Save: saves the configuration.

• Delete: shown only when editing an existing configuration. Removes it after confirmation.