---
title: Assigning Kron PAM Credentials to Target System Accounts
slug: kronpam-reference-guide-3-6-0/assigning-kron-pam-credentials-to-target-system-accounts
description: Learn how to configure and use the Assigned Credential feature in Kron PAM with this step-by-step guide. This feature allows users to connect to target devices using different credentials and assign specific privileged user accounts to user groups. Save S
docTags: 
createdAt: 2022-07-27T15:23:10.000Z
---

In some cases, Kron PAM users can be connected to target devices with different credentials. In other situations, there can be more than one privileged user account in the target system, with different user groups using different privileged accounts to log in to target systems. The Assigned Credential feature matches the Kron PAM users with target device users.

In the example below, User A wants to connect to the target system with Account X and User B connects to the target device with Account Y. In this case, User A is assigned to Account X, and User B is assigned to Account Y.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/gqnNGdfFMVghmSr5gwQUC_image.png "Assigned Credentials")

The following steps should be followed to configure the Assigned Credential feature and enable its use for a device group (this device group should be added to a device group realm with the user group including the users, beforehand).

1. Log in to the Kron PAM Web GUI as an admin user.
2. Navigate to **Devices >  Inventory > Device Groups.**
3. Select the device group and select the **Additional Credential** option.
4. Save the **Add Assigned Credential to Credential Selection** property as **true.**

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/amacEXxvyQbUBkN4ewgOb_image.png "Assigned Credential Configuration")

To set up assigned credentials for different users, first, save the Vault accounts. Once these accounts are saved, follow these steps:

1. Log in to the Kron PAM Web GUI as an admin user.
2. Configure **Vault** accounts for the target system.
3. Navigate to **Secrets > Vault > Add.**
4. After filling in the boxes in the figure below, click next and fill in Host (IP/Name). The matching IP number will appear there.
5. According to the selection above, select the **Vault Account** and click **Save.**
6. Navigate to **Users > Assigned Credential > Add > Add Credential**.
7. From the User Selection tab, you can select the Assigned Credential for a User or User Group here.


After completing these steps, whenever the Kron PAM users defined in the steps above are attempting to open an RDP session, the assigned credentials can be used for the connection.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/a4qBF9Mz5UAKrDDWVNExm_image.png "Assigned Credential Configuration")

To list only the accounts matching the relevant domain when listing users from the Vault account before the RDP session, the following steps are followed:

1. Navigate to **Secrets** > **Configuration.**
2. Choose **Active Directory > Connection > LDAP domain.**
3. Fill in the **LDAP domain.**
4. Choose **Active Directory** > **Miscellaneous **
5. Set **Show accounts in auto login options only if domains match**.
6. Navigate to** Connection** and fill in** LDAP **base DN according to domain.
7. Navigate to** Devices > Inventory > Related Device > Custom Properties.**
8. Add** remoteDesktop.domain **parameter key with** LDAP domain name.**

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/egrLFcCbXPxRJb8zrfIq7_image.png "Parameter for Domain Match on Active Directory Configuration")