Newly Discovered Users
This screen lists accounts that Kron PAM automatically finds on target devices, using strategies such as SSH, WinRM, SQL, or LDAP, where the device already has a Vault account but these accounts haven't been added to the Vault. Use the checkbox to the left of a user to select it, then add the account to the Vault or delete it from the target device. During discovery, Kron PAM also lists the groups that these users belong to.
For Windows targets discovered through the WinRM strategy, Kron PAM also determines whether each account is local or domain-based, and whether it acts as the identity (StartName) of a Windows Service on the server. The screen shows the following columns:
- Account: The user account, in HOSTNAME\username or domain\username format.
- User Type: The account type. See Account Type Values below.
- User Group: The local groups the account belongs to.
The screen lists the following columns for each discovered user:
Column | Description |
|---|---|
New User | The username Kron PAM found on the target device. |
User Group | The groups the new user belongs to on the target device. |
Time | The date and time Kron PAM discovered the user. |
Used Vault Account | The Vault account Kron PAM used to scan the device. |
Device IP Address | The IP address of the target device. |
Device Hostname | The hostname of the target device. |
Status | The discovery result, for example New User Found. |
Privilege Status | Whether the user has sudo privileges on the target device: Privileged or Non-Privileged. |
User Type | The account type, based on whether the account is local or domain-based and whether it's bound to a Windows Service: Local; Local, Service; or Domain, Service. |
Note: Kron PAM determines the User Type value only for Windows targets discovered through the WinRM strategy.
Kron PAM also tracks sudo privilege changes — grants and revocations — for accounts already managed in the Password Vault, not only for newly discovered users. You can review this history through Reports; it has no separate screen under Manage Vault.
Note: If a user's sudo privilege is granted and then revoked between two scheduled scans, and the final state matches the state before the change, Kron PAM may not record the intermediate change. This is a limitation of periodic scanning, not an error.
During the discovery of users on the target device, the groups to which those users belong are also listed.
