Dedicated directory accounts workflow

A workflow for Password Safe

Individual administrative accounts in Active Directory have permissions to all domain-joined Windows servers. Left unmanaged, these accounts are hard to audit and rotate, which increases the risk that a compromised credential grants broad access across your network. This workflow brings dedicated directory accounts under Password Safe control, so each account rotates automatically and only the matching user can access it.

Scope of this guide

This workflow shows you how to set up automatic password rotation for dedicated directory accounts on Windows servers in Password Safe. You configure Smart Groups that add these accounts to Password Safe management and map each one to its matching user.

Prerequisites

• Password Safe already manages all Windows domain-joined servers. See Add Local Admin Accounts for Windows Servers.
• You have a directory credential with privileges to discover services, tasks, systems, devices, users, and databases from Active Directory or LDAP. Create this credential in the BeyondInsight console under Configuration > Discovery and Vulnerability Management > Credentials.
• You have a functional account that can access the target assets with the privileges required to manage and change passwords on their accounts.
• You have a directory query configured to pull directory account details and populate the Smart Group.
• You have an access policy configured to allow approved RDP and SSH sessions.
• The privileged directory account and its corresponding unprivileged user account follow a matching naming convention, with a shared prefix or suffix. Without this match, the mapping action in the Smart Rule does not work.
• The user group you plan to map dedicated accounts to already exists in BeyondInsight.

Steps

Step 1: Create a managed account Smart Group to add dedicated accounts to Password Safe

1. From the left menu in the BeyondInsight console, select Smart Rules, select Managed Account from the Smart Rule Type filter list, and then select Create Smart Rule. Select Managed Accounts from the Category list, and enter a meaningful Name and Description for the Smart Rule.
2. Set the Selection Criteria to Directory Query, Include Accounts from Directory Query, and enable Discover Accounts for Password Safe Management. Set the Actions to link domain accounts to the applicable asset or managed system Smart Group, manage account settings with the applicable Password Rule (with Enable Automatic Password Management set to no), and show the managed account as a Smart Group. Select Create Smart Rule to save.

The Manage Account Settings action onboards the account if it's found in the system's scan results. This action also determines whether the account is rotated immediately. You can split these actions across multiple managed account Smart Groups using a Child Smart Rule or other specific criteria for the linking action, if needed.

Step 2: Create a managed account Smart Group to map dedicated accounts to Password Safe users

This Smart Group restricts access to the one user whose account name matches the dedicated account's prefix or suffix, then maps the dedicated account to that user's group. The user group must already exist in BeyondInsight for this rule action to work.

If a privileged account has no matching user to map to, Password Safe treats it as a shared account, visible to everyone in that user group.

1. From the left menu in the BeyondInsight console, select Smart Rules, select Managed Account from the Smart Rule Type filter list, and then select Create Smart Rule. Select Managed Accounts from the Category list, and enter a meaningful Name and Description for the Smart Rule.
2. Set the Selection Criteria to Dedicated Account, Account Name, with the applicable suffix. Set the Actions to map dedicated accounts to the applicable User Group and show the managed account as a Smart Group. Select Create Smart Rule to save.

Step 3: Assign user group permissions and roles for account access

Associate a user group to the Smart Group you created in Step 1, then assign permissions, a role, and an access policy to it. In this workflow, Password Safe users hold the Requestor role with an access policy that allows auto-approved RDP sessions.

The user group has read permission on the Smart Group you created in Step 2. Assigning the Password Safe role to that same Smart Group means each user only sees the privileged account that matches their name, even though the whole user group is assigned to the managed account Smart Group.

1. From the left navigation in the BeyondInsight console, select Configuration, and then select User Management under Role Based Access. Locate the user group in the grid, select its vertical ellipsis button, and then select View Group Details. From the Group Details pane, select Smart Groups.
2. In the Smart Groups Permissions grid, select the Smart Group you created in Step 1, and then select its vertical ellipsis button. Select Edit Password Safe Roles, select the Requestor role and the applicable Access Policy, and then select Save Roles.

Verify the results

Confirm that the dedicated directory account appears as a managed account in Password Safe and rotates on its assigned schedule. Verify that only the user whose name matches the account can see and request it, and that the user group holds the Requestor role and access policy on the Smart Group.

Next steps

• Add Dedicated Directory Accounts for Entra ID: Extend this same pattern to Entra ID directory accounts.
• Define Just-in-time access policies: Tighten access further by granting permissions only for the duration of a request.