---
title: Assigning Kron PAM Credentials to Target System Accounts
slug: kronpam-reference-guide-3-9-0/E2NV-assigning-kron-pam-credentials-to-target-system-accounts
description: Learn how to configure and use the Assigned Credential feature in Kron PAM with this step-by-step guide. This feature allows users to connect to target devices using different credentials and assign specific privileged user accounts to user groups. Save S
docTags: 
createdAt: 2022-07-27T15:23:10.000Z
---

In some cases, there are more than one privileged user account in the target system and different user groups use different privileged accounts to log in to them. The Assigned Credential feature matches the Kron PAM users with different target device users from the [Password Vault](docId\:yUVFx_u4NERDT13ut4Of7).


In the example below, User A wants to connect to the target system with Account X and User B wants to connect to the target device with Account Y. In this case, User A is assigned to Account X, and User B is assigned to Account Y.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/G_iHGfQv8M3ojRq5BYyQl_image.png" size="68" width="949" height="773" position="center" caption="Assigned Credentials" showCaption="true"}

The following steps should be followed to configure the Assigned Credential feature and enable its use for a device group.

:::hint{type="info"}
This device group should be added to a device realm with the user group including the users beforehand.
:::

1. Log in to the Kron PAM Web GUI as an administrator.
2. Navigate to **Devices >  Inventory > Device Groups.**
3. Click the desired Device Group and select **Properties**.
4. Click the **Edit **and then** Next **buttons.
5. Under the **Additional Credentials** toggle on the** Add Assigned Credential to Credential Selection** property.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/-kCWWASDYq0ZX_QJOetqY_image.png)

To set up the assigned credentials for different users, save the accounts to the Vault before doing anything else. After saving these accounts, follow these steps:

1. Log in to the Kron PAM Web GUI as an admin user.
2. Configure the Vault account for the target system.
3. Navigate to **User **> **Assigned Credential**.
4. Click the **Add** button and continue with **User Selection** and **Vault Account Select** the Kron PAM user as **User **and the Vault account as **Vault Account.**
5. Click the **Save **button.

Once these steps are completed, assigned credentials will be used for the connection whenever the defined users try to open an RDP session.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/kOt5yw7XBlEjiIy7R1Ucm_image.png" size="66" width="667" height="653" position="center" showCaption="false"}

To list only the accounts matching the relevant domain when listing users from the Vault account before the RDP session, follow these steps:

1. Navigate to **Secrets** > **Configuration.**
2. Choose **Active Directory > Connection > LDAP domain.**
3. Fill in the **LDAP domain.**
4. Choose **Active Directory** > **Miscellaneous **
5. Set **Show accounts in auto login options only if domains match**.
6. Navigate to** Connection** and fill in** LDAP **base DN according to domain.
7. Navigate to** Devices > Inventory > Related Device > Custom Properties.**
8. Add** remoteDesktop.domain **parameter key with** LDAP domain name.**



::Image[]{src="https://app.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/dGa5u7qZorFRm5xSEDDYp_image.png" size="80" width="651" height="782" position="center" caption="Parameter for Domain Match on Active Directory Configuration" showCaption="true"}

The **Specified Time Interval **option in the **Assigned Credential** screen makes it possible to connect and perform actions for Vault Accounts defined under **Remote Application**, **SSH Proxy**, and **HTTP Proxy** services within a specific time interval. Once the time has expired, credential assignment will end and the account is not going to be listed among connection options.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/NcO2mszhub5AcqLVnQAzv_image.png" size="70" width="810" height="962" position="center" caption="Assigned Credential Specified Time Interval Definition Screen" showCaption="true"}