Active Directory

With the Directory, the AI Assistant and pre-diagnostics can read your Active Directory: whether an account is locked, disabled, whether its password has expired, which groups it belongs to. Reads happen on demand and nothing is written; every lookup is recorded in the audit log.

#Set it up

1. On a domain member server, never on a domain controller, enable the agent's Annuaire module (gear button on its card in FSI Agents).
2. In Settings → Directory, click Declare a domain and enter the domain, the Primary agent and, if you like, a Backup agent.
3. Test: a "read succeeded" message confirms everything works.

The agent reads with its server's computer account, which already has read access to the directory. It refuses to run on a domain controller (Refused: domain controller) or with an account that is too privileged (Disabled: account too privileged). A domain can only belong to one customer.

#Check the agent's key

Each agent signs its answers with its own key. The Agents running the module list shows that key's fingerprint; compare it with the one written in the agent's log. Revoke key forces the agent to create a new one.

#Choose what the AI can read

Full object read lets the assistant read every attribute of one object at a time: mail, job title, department, manager… Nothing is kept after the answer.

Two modes are available: All attributes, except masked ones, or Only the listed attributes. In the masked attributes list, put one attribute per line, with a trailing * for a prefix (msExch*). Mask personal contact details fills the list with phone numbers and addresses.

Secrets (passwords and their hashes, LAPS, BitLocker…) are always excluded, whatever the options.

#Who can use it

In the assistant, directory tools are reserved for the customer's administrators. Pre-diagnostics uses it for tickets about an account or a group.

Source: · FirstSI Docs · updated 2026-10-10