Doman Master Account for Windows Endpoints Bootstrapping

[suresh_ravuri]

We have onboarded 50+ Windows devices using the Domain master account. We are in the process of rotating the password for the master account, so do we need to update the new password in each windows connection or is there another way to sync the password for all the connections ?

[NageshK · Accepted solution]

@suresh_ravuri Thanks for posting your question. When domain joined windows machines get bootstrapped, every individual server's connection will have the same vault path as that of the master connection  (ex: kv-v2/-MASTER-WINDOWS-CONNECTION). However, when you rotate the pwd of the domain account, its latest password will be stored in the path associated with the AD Endpoint name (ex: kv-v2/AD_EP_Name/domain_account_name).

So, if you rotate the pwd, you will have to update the vault path in the master windows connection to match the AD EP name path (kv-v2/AD_EP_Name/domain_account_name) (refer to screenshot 1 below) and also click on "Advanced" button against the path and update the text box to have the value as "password" (refer to screenshot 2 below). Now repeat this in all of the 50 individual connections to match the values mentioned in master windows connection. This is a one time activity. Once it is done, you can keep rotating the domain acct pwd without any further need of a manual intervention. And any new VMs that get bootstrapped from then will have the right vault path.

1. 

2. 

Thanks,

Nagesh K 

[suresh_ravuri]

Thank you Nagesh, it worked.

We have 375+ Windows connections, is there a way to update vault path for all the Windows connection ?