> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/pam-configuration/domain-controller-environment-setup.md).
# Domain Controller Environment Setup
## Domain Controller Environment Overview
Resources in your environment attached to a domain controller can be managed by a Keeper Gateway using a specified administrator credential configured in the PAM Configuration record. This guide provides step-by-step instructions for configuring the PAM Configuration for your tenant, enabling the Keeper Gateway to manage users and groups within it.
### Prerequisites
1. Prior to proceeding with this guide, make sure to [install and configure your Keeper Gateway](/keeperpam/privileged-access-manager/getting-started/gateways/one-time-access-token.md).
2. A Domain Controller (Active Directory or LDAP) needs to be running and accessible by the Keeper Gateway.
3. Create a service user which has administrative privileges to manage users and groups in the domain controller
1. This user can be the administrator user, or a specific service user with proper permissions
2. In the following example, the PAM Configuration is set to use the administrator user
## Setting up Domain Controller PAM Configuration
In order to integrate a domain controller into Keeper and manage the users and groups through KeeperPAM, the following information is needed:
1. Administrative Credential
2. Hostname or IP Address
3. Host Port
4. Domain ID
5. (Optional) User Match Query
The Domain ID tenant in our example will be "KEEPERPAMLAB" and the administrative credential will be set to the NETBIOS username "KEEPERPAMLAB\Administrator".
### Create a PAM User for Administrative Credentials
In the application folder, create a new PAM User for the administrative credential. This will be in the NETBIOS format "KEEPERPAMLAB\Administrator" (or whatever the username is in the tenant). In the example below, the Distinguished Name is also being set as it would be used in the domain controller.
### Create the PAM Configuration
In the PAM Configurations page, create a new configuration and set the following options:
* Environment: Domain Controller
* Gateway: the gateway from above
* Application Folder: app folder created for application
* Administrative Credential: domain user created above ("KEEPERPAMLAB\Administrator")
* Hostname / IP: the hostname or IP relative to the gateway
* Port: 636 (typical LDAPS port)
* Domain ID: keeperpamlab.com
### Validation Test
In order to validate that the PAM Configuration attaches correctly, you can run a Discovery job. Navigate to Discovery, and click "Create a Discovery Job". Select the correct gateway and start the discovery job. It can take a few attempts to get correct, since the configuration needs to be correct. In the following example, the discovery job finds two users in the domain controller instance.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/pam-configuration/domain-controller-environment-setup.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.