> For the complete documentation index, see [llms.txt](https://newdocs.keeper.io/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://newdocs.keeper.io/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud/elevating-access-using-ad-domain-controller.md).

# Elevating Access using AD Domain Controller

<figure><img src="/files/w7wGeZFcXGhnz1UV6GDU" alt=""><figcaption></figcaption></figure>

## Overview

In this guide, you'll learn how to elevate Active Directory user permissions using KeeperPAM. This guide covers just-in-time privilege elevation to resources in an environment where a domain controller is the acting identity provider.

With Keeper Privileged Cloud, users request access through a shared PAM resource. After approval, KeeperPAM grants temporary group-based elevation in the domain controller for the approved time window and removes it automatically when access expires.

Use this model when the domain controller manages authentication and authorization directly and access must be approved, time-bound, and fully auditable.

## Prerequisites

This guide assumes the following tasks have already taken place:

* A Keeper Secrets Manager [application](/en/keeperpam/privileged-access-manager/getting-started/applications.md) has been created
* Your [Keeper Gateway](/en/keeperpam/privileged-access-manager/getting-started/gateways.md) is online
* [Domain Controller Environment Setup](/en/keeperpam/privileged-access-manager/getting-started/pam-configuration/domain-controller-environment-setup.md) has been completed and is using LDAPS (port 636)
* The Keeper Gateway is able to connect to your Active Directory via LDAPS (port 636)

### 1. Setup a PAM User Record

Keeper PAM will use the credentials in this PAM User record to manage other accounts in your directory. This account does not need to be a domain admin account, but needs to be able to successfully change group memberships for accounts within the domain.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FTdolMVL5fQvfl1hcbJeJ%2FScreenshot%202025-09-17%20101134.png?alt=media&#x26;token=601154ee-172d-4aab-ae03-7a34bf835af9" alt="PAM User record for AD Admin" width="362"><figcaption><p>PAM User record for AD Admin</p></figcaption></figure>

{% hint style="info" %}
The PAM User record needs to be in a shared folder that is shared to the KSM application created in the pre-requisites. Only the KSM application needs access to this privileged account, it does not need to be shared with any users.
{% endhint %}

#### PAM User Record Fields

<table><thead><tr><th width="194.5">Field</th><th>Description</th></tr></thead><tbody><tr><td><strong>Record Type</strong></td><td>PAM User</td></tr><tr><td><strong>Title</strong></td><td>Keeper record title</td></tr><tr><td><strong>Login</strong></td><td><p>The username of the Active Directory admin. The format of the username depends on the target system and type of service.<br><br>Examples:<br><code>DOMAIN\Administrator</code></p><p><code>Administrator@domain.local</code></p></td></tr><tr><td><strong>Password</strong></td><td>Password of the admin user on the Active Directory.</td></tr><tr><td><strong>Distinguished Name</strong></td><td>Full Distinguished Name (DN) of the admin user on the Active Directory.</td></tr></tbody></table>

### 2. Setup a PAM Configuration

A [PAM Configuration](/en/keeperpam/privileged-access-manager/getting-started/pam-configuration.md) associates an environment with a Keeper Gateway and credentials. If you don't have a PAM Configuration set up yet for this use case, create one.

<table><thead><tr><th width="200">Field</th><th>Description</th><th data-hidden></th></tr></thead><tbody><tr><td><strong>Title</strong></td><td>Configuration name, example: <code>Active Directory Example</code></td><td></td></tr><tr><td><strong>Environment</strong></td><td>Select: <code>Domain Controller</code></td><td></td></tr><tr><td><strong>Gateway</strong></td><td>Select the Gateway that has access to your directory server</td><td></td></tr><tr><td><strong>Application Folder</strong></td><td>Select the Shared folder that contains the PAM User record created in step 1.</td><td></td></tr><tr><td><strong>Administrative Credential</strong></td><td>Select the PAM User record created in step 1.</td><td></td></tr><tr><td>Hostname or IP Address</td><td>Enter the domain or IP address of your Active Directory domain.</td><td></td></tr><tr><td>Port</td><td>Enter 636 (LDAPS)</td><td></td></tr><tr><td>Use SSL</td><td>Ensure this checkbox is checked if using LDAPS</td><td></td></tr></tbody></table>

### 3. Setup PAM records

### Configure and Share the PAM Machine Resource

In the example below, a PAM Machine record is configured to grant elevated access through Active Directory. Select **Edit** in **PAM Settings** to configure Workflow and JIT.

These directions can also be used to elevate a user for accessing a LDAP connected database.

See [SSH Connections](/en/keeperpam/privileged-access-manager/connections/session-protocols/ssh-connections.md) for more detailed configuration information

<figure><img src="/files/g0GVuUFHUce4T0WNLN0x" alt=""><figcaption></figcaption></figure>

#### **JIT Settings**

JIT settings define how access is granted after approval. In this example, the record uses group-based privilege elevation. Because this machine authenticates through Active Directory, enable authentication through the identity provider. The group name must match the corresponding group in the domain controller. After approval, the user receives temporary elevation for the configured duration. Role-based elevation is not supported through identity-provider elevation at this time.

<figure><img src="/files/ZVWMaW5NaRacilCpY51N" alt=""><figcaption></figcaption></figure>

#### **Workflow Settings**

Workflow settings define the approval controls for the record. In this example, the record requires approval and limits access to 5 minutes, which overrides the expiration in the JIT settings. When the access window ends, any active session closes and the temporary elevation is removed. You can also require a reason and ticket number with each request.

See [Workflow](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/workflow.md) for more information.

<figure><img src="/files/JkxvODTVPaeQObDXq65B" alt=""><figcaption></figcaption></figure>

### Requesting Access

Once the PAM Machine record is shared and JIT and Workflow settings are configured, the user can submit an access request from the Keeper Vault or from Commander.

See [Keeper Privileged Cloud](/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud.md#access-workflow) for a full workflow.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://newdocs.keeper.io/en/keeperpam/privileged-access-manager/just-in-time-access-jit/keeper-privileged-cloud/elevating-access-using-ad-domain-controller.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.