Directory agent: run it close to the domain controller
VaultPilot DC Agent Service is a Windows service that runs close to the domain controller. It syncs OU, group, and user metadata from the directory into VaultPilot. The AD bind password stays on the machine that runs the agent.
- Runtime
- Windows service near the DC
- Credential entry
- Local secure prompt
- Sent to the server
- OU, group, and user metadata
- Current agent
- 1.2.27
Enroll and install the agent
In VaultPilot, create an agent record under Integrations > Active Directory. Download vaultpilot-dc-agent.ps1 from the release assets or from the interface. Run the generated install command on the agent machine in an Administrator PowerShell session. The command may still show older PassMan names for compatibility, so run it exactly as generated.
Secrets go in at the local prompt
The script asks in the local terminal for the domain controller, the bind username, and the bind password. The agent token is entered at the same secure prompt. Never put the token on the command line, where it ends up in terminal history. Prepare the following before you install.
What the agent collects and never sends
The agent collects only OU, group, and user metadata. It never reads or sends AD passwords, password hashes, Kerberos tickets, vault keys, or plaintext secrets.
Version and readiness checks
VaultPilot 3.0.3 ships DC Agent 1.2.27, and both the service wrapper and the PowerShell worker should report 1.2.27 and ready. A successful sync does not upgrade the agent. Unlocking an account, requiring a password change, assigning a random password, and disabling an account need at least 1.2.20; older agents keep syncing but cannot run these actions.
Repair, token replacement, and removal
For an installed service, replace the token with the command on the existing provider card. The old token stops working immediately. The repair command keeps the same Windows service and must contain only -PromptAgentToken; paste the new token only into the local prompt. To remove the agent, use -UninstallService.
Limits to know
- A working sync does not mean sensitive directory actions are ready; missing or drifting target identity data keeps them closed.
- Built-in identities and the agent's own bind identity are always protected from agent actions.
- Agent tokens, real directory dumps, and unredacted logs never go into a support request.
Check step by step
- 01
Create the agent record and run the generated command on the intended machine.
- 02
Enter the bind credentials and the agent token only at the local secure prompt.
- 03
Confirm that the wrapper and worker report 1.2.27 and ready, and that a sync completes.
- 04
When you retire the integration, revoke the token and remove the service.
Read more in the guides: Active Directory agent guide, DC Agent service troubleshooting, Active Directory records screen