en-US - - English

Account Discovery

With a privileged account (a service account), PassMan can discover the other accounts on the target, add them to your list, and even generate new passwords for them while doing so.

In PassMan, only an admin account can be made a service account (S), and there can be only one S account per target. For this to succeed, you must enable (or check) PowerShell remoting on the remote machine. It is enough to do this once on the target system, from any admin account. If the setting is correct, the account stays in sync after it is made a service account. Otherwise it becomes out of sync.

If you want to discover the accounts of a domain controller (DC) machine, and the accounts on the member machines where services run under the DC machine's accounts, follow this description.

Preparing the discovery

First you need an account with admin rights, added to PassMan with valid credentials so that it is in sync. Select Service Account for this admin account in its edit dialog, and then Save. If PowerShell remoting is set up correctly on the target, the change is saved successfully.

Discovering accounts

  1. On the Targets tab, open the menu of the target (right-click, or the ... menu), and open the accounts of the target. At the bottom of the window, in the middle, there is a button to discover accounts.
  2. Selecting the button starts the discovery (a few seconds at most). PassMan then lists every account on the target.

Use the checkboxes to add the accounts you want. A message tells you whether the operation succeeded.

The discovery cannot recover the passwords of the discovered accounts, because Windows does not allow that either. In this case, PassMan adds the accounts to the list without credentials.

You can have the passwords of the accounts changed to new generated passwords while they are added, so that the accounts are in sync. For this, select the password change option next to the add checkbox for the account.

If a service runs under an account, the service owner column shows it: such accounts have S in their row.

If you allowed Change password of services too when you edited the target, adding the account updates both the sign-in password and the password of the service. You can read more about updating a service password in Service-password update.