---
title: Active Directory Device Discovery on System Configuration Manager
slug: kronpam-reference-guide-3-9-0/active-directory-device-discovery-on-system-configuration-manager
docTags:
createdAt: 2026-05-10T19:13:35.732Z
---
LDAP or Active Directory devices can be integrated with Kron PAM. Some properties must be added from the System Configuration Manager for discovery configuration.
1. Navigate to** Administration** >** System Configuration Manager.**
2. Click “Add” and then “Add New System Parameter”.
3. Enter the related configuration parameter and its value as shown below.
4. Click to “Save”.
5. Repeat the steps above for each parameter separately.
Then values at the end of parameters must continue with integers starting from 0.
| **Parameter Name** | **Description** | **Value** |
| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
| **sc.device.integration.ldap.url** | ***Mandatory***
The LDAP or AD server URL. Can be an IP address or DNS. Multiple URLs can be separated by #. This helps ensure high availability. | ldap\://10.20.30.40:389#ldap\://10.20.30.41:389 |
| **sc.device.integration.ldap.baseDN\_n** | ***Mandatory***
Base Distinguished Name (DN) from where LDAP discovery starts. All devices and groups will be nested under this base. Use \` for multiple base DNs. | OU=MyOrganizationalUnit,DC=krontech-new,DC=internal |
| **sc.integration.ldap.eid\_n** | ***Mandatory***
The LDAP/AD username used to bind and perform searches. This account must have read access to LDAP/AD. | svc\_discovery\_user |
| **sc.device.integration.ldap.password\_n** | ***Mandatory***
Password for the LDAP/AD bind user defined in eid\_n. Secure this field as it contains sensitive information. | YourSecurePassword123! |
| **sc.device.integration.ldap.source.name\_n** | ***Mandatory***
A user-defined label representing this discovery source as discoverySource in Kron PAM. Helpful when managing multiple discovery integrations. | corpADDiscovery |
| **sc.device.integration.ldap.root.device.group\_n** | ***Mandatory***
Specifies the root device group name in Kron PAM. The value must be provided, but the naming is user-defined. Given values should be added as device groups in Devices page on Kron PAM.
All discovered devices/groups will be placed under this. Helps organize and segment devices. | AD\_Discovered\_Devices |
| **sc.device.integration.ldap.use.membership\_n** | ***Optional***
Enables group discovery strategy based on memberOf attribute. Use true for memberOf-based recursion; false to use distinguishedName path logic. If this parameter is configured, "sc.device.integration.ldap.root.device.group\_n" parameter should also be defined.
Check notes below for detailed description. | true/false |
| **sc.device.integration.ldap.device.group.search.phrase\_n** | ***Mandatory***
LDAP search filter for device groups. Required if use.membership is enabled. | (\|(objectClass=group)(objectClass=organizationalUnit)) |
| **sc.device.integration.ldap.device.search.phrase\_n** | ***Mandatory***
LDAP search filter for discovering devices. Should match device object types like computer or device. | (objectClass=computer) |
| **sc.device.integration.ldap.device.ip.attribute\_n** | **Mandatory** Attribute name in LDAP holding device IP information. Must be set for devices to be accessed via Kron PAM. | dNSHostName |
| **sc.device.integration.ldap.device.hostname.attribute\_n** | ***Optional***
LDAP attribute for device hostname. Used in Kron PAM UI for display purposes. | cn |
| **sc.device.integration.ldap.device.access.protocol.attribute\_n** | ***Optional***
Attribute storing which access protocol (e.g., SSH, RDP) each device uses. Helps auto-assign access methods. | accessProtocol |
| **sc.device.integration.ldap.device.default.access.protocol\_n** | ***Mandatory***
Default protocol to use if the access protocol attribute isn’t provided or returns empty. | RDP |
| **sc.device.integration.ldap.device.element.type.id.attribute\_n** | ***Optional***
LDAP attribute indicating the element type (e.g., OS or device type). Used for detailed classification. | osType |
| **sc.device.integration.ldap.device.default.element.type.id\_n** | ***Mandatory***
Default element type used if the LDAP attribute is missing or not resolvable. | windows |
| **sc.device.integration.ldap.device.port.attribute\_n** | ***Optional***
LDAP attribute containing device access port. Used if specific devices use non-default ports. | portNumber |
| **sc.device.integration.ldap.device.default.port\_n** | ***Optional***
Default port value to use when no LDAP attribute is defined or returned. Falls back to standard protocol defaults (e.g., 22 for SSH). | 3389 |
| **sc.device.integration.ldap.allow\.device.in.multiple.groups\_n** | ***Optional***
It is used to add devices into multiple device groups according to their membership relations in LDAP server | true/false |
| **sc.device.integration.ldap.device.group.collect.tree\_n** | ***Optional***
This parameter enables the import of device groups in a tree (hierarchical) structure using the memberOf attribute from LDAP. When set to true, Kron PAM builds the parent-child relationships between device groups based on the memberOf attribute and organizes them accordingly. If set to false, the groups are imported in a flat structure without hierarchy. The default value is true, and it's typically recommended for AD environments where group relationships are defined via memberOf. | true/false |
| **sc.device.integration.ldap.import.ou.as.group\_n** | ***Optional***
This parameter defines how devices are assigned to device groups during LDAP discovery. When set to true, Kron PAM will use the Organizational Unit (OU) path in the device’s distinguishedName (DN) to determine the group structure instead of relying on the memberOf attribute. Each OU in the DN (excluding the Base DN) is treated as a device group and structured hierarchically. When set to false (default), device group assignment is handled based on memberOf relationships, assuming use.membership is enabled. Default value is false. | true/false |
| **sc.device.integration.ldap.url** | ***Mandatory***
The LDAP or AD server URL. Can be an IP address or DNS. Multiple URLs can be separated by #. This helps ensure high availability. | ldap\://10.20.30.40:389#ldap\://10.20.30.41:389 |
After defining the above parameters in System Configuration Manager on Kron PAM, apply the steps outlined in the [Adding Devices Automatically](docId\:FaoT28ljbbtGuq18269RA) or [Trigger LDAP Sync Jobs Manually](docId\:hol7K-SvQKhvZ_JXcn9JT) sections to make LDAP/AD device integration.
:::hint{type="info"}
If the device tree structure has both device and device groups under a parent device group, then the device group is duplicated, and an underscore “\_” is added at the end of the device group name.
:::
:::hint{type="info"}
Multiple LDAP device integrations can be performed by duplicating the "xxx\_n" type parameters. It must have sequential numbers, starting from “0” (zero) for each LDAP, like sc.device.integration.ldap.baseDN\_0, sc.device.integration.ldap.baseDN\_1, sc.device.integration.ldap.baseDN\_2
:::
:::hint{type="info"}
**sc.device.integration.ldap.use.membership\_n**
In Active Directory, **device group hierarchy** can be built using two different approaches: the **memberOf attribute** or the **Organizational Unit (OU) structure** defined in the device’s **Distinguished Name (DN)**.
- The **memberOf attribute** is an explicit reference within an object (e.g., a device or group) that points to one or more groups it belongs to. When using this method, group relationships are discovered by following these memberOf links recursively, allowing Kron PAM to construct a hierarchical tree of nested groups based on actual group memberships.
- The **OU structure**, on the other hand, is based on the **directory path** in which an object is located. This path is represented in the object's **Distinguished Name (DN)** and reflects the administrative or organizational placement within Active Directory. When this method is used, Kron PAM parses the DN and converts each OU in the path into a device group, building a hierarchy that mirrors the AD structure, regardless of memberOf relationships.
Choosing between memberOf and OU-based discovery depends on how group relationships are managed in your AD environment.
This parameter defines how Kron PAM discovers and organizes device groups from LDAP.
- When set to **true**, Kron PAM uses the **memberOf attribute** to build the **device group hierarchy recursively**. It follows each device's or group's memberOf references to determine parent-child relationships, allowing a **nested (tree-like) structure** to be imported from LDAP.
- When set to **false**, Kron PAM **does not rely on memberOf**. Instead, it analyzes the **device's distinguishedName (DN)** and converts each Organizational Unit (OU) in the DN path into a corresponding device group. This creates a group hierarchy based on the **OU structure** in Active Directory.
:::