---
title: Active Directory Device Discovery
slug: kronpam-reference-guide-3-8-0/active-directory-device-discovery
description: Learn how to integrate LDAP or Active Directory devices with Kron PAM step-by-step using this comprehensive document. Discover the key system configuration properties you need to modify and the importance of unique device group names for smooth LDAP impor
docTags:
createdAt: 2022-07-26T12:46:18.000Z
---
LDAP or Active Directory devices can be integrated with Kron PAM. Some properties must be added from the System Configuration Manager for the discovery configuration.
1. Navigate to** Administration > System Configuration Manager.**
2. Click **+Add **to open the **Add New System Parameter **modal.
3. Enter the related configuration parameter and its value as shown below.
4. **Save.**
5. Repeat steps 2 to 4 for each parameter separately.
The n values at the end of some of the parameters need to be replaced with integers starting from 0.
| **Parameter Name** | **Description** | **Value** |
| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| sc.device.integration.ldap.url | ***Mandatory.***
The LDAP or AD server URL. Can be an IP address or a DNS. Multiple URLs can be separated by #. This helps ensure high availability. | ldap\://10.20.30.40:389#ldap\://10.20.30.41:389 |
| sc.device.integration.ldap.baseDN\_n | ***Mandatory.***
Base Distinguished Name (DN) from where LDAP discovery starts. All devices and groups will be nested under this base. Use \` for multiple base DNs. | OU=MyOrganizationalUnit,DC=krontech-new,DC=internal |
| sc.device.integration.ldap.eid\_n | ***Mandatory.***
The LDAP/AD username used to bind and perform searches. This account must have read access to LDAP/AD. | svc\_discovery\_user |
| sc.device.integration.ldap.password\_n | ***Mandatory.***
Password for the LDAP/AD bind user defined in eid\_n. Secure this field as it contains sensitive information. | YourSecurePassword123! |
| sc.device.integration.ldap.source.name\_n | ***Mandatory.***
A user-defined label representing this discovery source in Kron PAM. Helpful when managing multiple discovery integrations. | corpADDiscovery |
| sc.device.integration.ldap.root.device.group\_n | ***Mandatory.***
Optional root device group name in Kron PAM. All discovered devices/groups will be placed under this. Helps organize and segment devices. | AD\_Discovered\_Devices |
| sc.device.integration.ldap.user.membership\_n | ***Optional.***
Enables group discovery strategy based on memberOf attribute. Set as**true **for memberOf-based recursion; **false **to use distinguishedName path logic. This parameter only works in conjunction with "sc.device.integration.ldap.root.device.group\_n". | true/false |
| sc.device.integration.ldap.device.group.search.phrase\_n | ***Mandatory.***
LDAP search filter for device groups. Required if user.membership is enabled. | (\|(objectClass=group)(objectClass=organizationalUnit)) |
| sc.device.integration.ldap.device.search.phrase\_n | ***Mandatory.***
LDAP search filter for discovering devices. Needs to match device object types like "computer" or "device". | (objectClass=computer) |
| sc.device.integration.ldap.device.ip.attribute\_n | ***Mandatory. ***
The attribute name in LDAP holds device IP information. Must be set for devices to be accessed via Kron PAM. | dNSHostName |
| sc.device.integration.ldap.device.hostname.attribute\_n | ***Optional.***
LDAP attribute for device hostname. Used in Kron PAM UI for display purposes. | cn |
| sc.device.integration.ldap.device.access.protocol.attribute\_n | ***Optional.***
Attribute storing which access protocol (e.g., SSH, RDP) each device uses. Helps auto-assign access methods. | accessProtocol |
| sc.device.integration.ldap.device.default.access.protocol\_n | ***Mandatory.***
Default protocol to use if the access protocol attribute isn’t provided or returns empty. | RDP |
| sc.device.integration.ldap.device.element.type.id.attribute\_n | ***Optional.***
LDAP attribute indicating the element type (e.g., OS or device type). Used for detailed classification. | osType |
| sc.device.integration.ldap.device.default.element.type.id\_n | ***Mandatory.***
The default element type is used if the LDAP attribute is missing or not resolvable. | windows |
| sc.device.integration.ldap.device.port.attribute\_n | ***Optional.***
LDAP attribute containing device access port. Used if specific devices use non-default ports. | portNumber |
| sc.device.integration.ldap.device.default.port\_n | ***Optional.***
The default port value to use when no LDAP attribute is defined or returned. Falls back to standard protocol defaults (e.g., 22 for SSH). | 3389 |
| sc.device.integration.ldap.allow\.device.in.multiple.groups\_n | ***Optional.***
It is used to add devices to multiple device groups according to their membership relations in the LDAP server.
| true/false |
| sc.device.integration.ldap.device.group.collect.tree\_n | ***Optional.***
This parameter enables the import of device groups in a tree (hierarchical) structure using the memberOf attribute from LDAP. When set to true, Kron PAM builds the parent-child relationships between device groups based on the memberOf attribute and organizes them accordingly. If set to false, the groups are imported in a flat structure without hierarchy. The default value is true, and it's typically recommended for AD environments where group relationships are defined via memberOf. | true/false |
| sc.device.integration.ldap.import.ou.as.group\_n | ***Optional.***
This parameter defines how devices are assigned to device groups during LDAP discovery. When set to **true**, Kron PAM will use the Organizational Unit (OU) path in the device’s distinguishedName (DN) to determine the group structure instead of relying on the memberOf attribute. Each OU in the DN (excluding the Base DN) is treated as a device group and structured hierarchically. When set to **false**, device group assignment is handled based on memberOf relationships, assuming user.membership is enabled. The default value is **false**. | true/false |
| sc.device.integration.ldap.url | ***Mandatory.***
The LDAP or AD server URL. Can be an IP address or a DNS. Multiple URLs can be separated by #. This helps ensure high availability.
| ldap\://10.20.30.40:389#ldap\://10.20.30.41:389 |
- After entering the necessary parameters, apply the steps outlined in the [Adding Devices Automatically](docId\:RrU_taKHER0SHFdlgRgls) or [Manually Trigger LDAP Sync Job](docId:6nByzdUCQLziSaQWuP8Nh) sections to complete LDAP/AD device integration.
:::hint{type="info"}
If the device tree structure has both devices and device groups under a parent device group, then the device group is duplicated, and an underscore “**\_**” is added at the end of the device group name.
Example:
**DeviceList-01** device group on AD has devices and device groups. Therefore, **DeviceList-01 **and **DeviceList-01\_ **groups are created on Kron PAM.
:::
:::hint{type="info"}
Multiple LDAP device integrations can be performed by duplicating the **xxx\_n** type parameters. Relevant parameters must have sequential numbers, starting from “0” (zero) for each LDAP, like **sc.device.integration.ldap.baseDN\_0, sc.device.integration.ldap.baseDN\_1, sc.device.integration.ldap.baseDN\_2**
:::
:::hint{type="info"}
**sc.device.integration.ldap.user.membership\_n**
****
In Active Directory, **device group hierarchy** can be built using two different approaches: the **memberOf attribute** or the **Organizational Unit (OU) structure** defined in the device’s **Distinguished Name (DN)**.
- The **memberOf attribute** is an explicit reference within an object (e.g., a device or group) that points to the group(s) it belongs to. When using this method, group relationships are discovered by following these memberOf links recursively, allowing Kron PAM to construct a hierarchical tree of nested groups based on actual group memberships.
- The **OU structure**, on the other hand, is based on the **directory path** in which an object is located. This path is represented in the object's **Distinguished Name (DN)** and reflects the administrative or organizational placement within Active Directory. When this method is used, Kron PAM parses the DN and converts each OU in the path into a device group, building a hierarchy that mirrors the AD structure, regardless of memberOf relationships.
Choosing between memberOf and OU-based discovery depends on how group relationships are managed in your AD environment.
This parameter defines how Kron PAM discovers and organizes device groups from LDAP.
- When set to **true**, Kron PAM uses the **memberOf attribute** to build the **device group hierarchy recursively**. It follows each device's or group's memberOf references to determine parent-child relationships, allowing a **nested (tree-like) structure** to be imported from LDAP.
- When set to **false**, Kron PAM **does not rely on memberOf**. Instead, it analyzes the **device's distinguishedName (DN)** and converts each Organizational Unit (OU) in the DN path into a corresponding device group. This creates a group hierarchy based on the **OU structure** in Active Directory.
If this parameter is set (either true or false), you must also define the parameter sc.device.integration.ldap.root.device.group\_n to specify the root group under which all discovered groups and devices will be placed.
:::