Service Account Dependency Discovery and Onboarding
Discover Windows services, scheduled tasks, and IIS application pools running under Active Directory or local Windows accounts, and keep them running through password rotation.
Service Account Discovery and Onboarding extends Account Discovery by detecting Windows services, scheduled tasks, and IIS application pools (collectively, dependencies) that run under Active Directory or Windows local accounts. Once dependencies are discovered, Syteca can manage them automatically during account onboarding and remote password rotation - so services keep running after credentials change.
Use this when you need to:
Rotate a service account’s password without breaking every Windows service, scheduled task, or IIS pool that authenticates with it.
Get visibility into which systems and services depend on a given privileged account before you touch its credentials.
Discover and track Group Managed Service Accounts (gMSA) dependencies, even though gMSA accounts themselves are managed by Active Directory and can’t be onboarded.
Applies only to Active Directory Discovery and Computer Discovery rule types. Linux Discovery rules don’t support dependency scanning.
The Account Discovery page requires the administrative Privileged Accounts Management permission and a PAM seat license.
1.3 IIS Application Pools - prerequisites for WMI/PowerShell scanning
1
Enable IIS Management Scripts and Tools
On the target computer, open Control Panel > Programs > Programs and Features, click Turn Windows features on or off, navigate to Internet Information Services > Web Management Tools, and enable IIS Management Scripts and Tools.
Enabling IIS Management Scripts and Tools in Windows Features.
Restart the computer.
IIS version 7 or later is required.
2
Grant WMI namespace permissions for root\WebAdministration
To let the discovery account query IIS configuration via WMI:
1
Open WMI Control
Press Win+R, type wmimgmt.msc, press Enter.
2
Open Properties
Right-click WMI Control (Local), select Properties, and go to the Security tab.
3
Navigate to the namespace
Expand the namespace tree to root\WebAdministration, select it, and click Security.
4
Add the account
Click Add…, enter the username or group, and click OK.
5
Grant permissions
Select the user or group, and check Allow for Remote Enable and Execute Methods (optionally also Read Security and Provider Write).
Granting Remote Enable and Execute Methods permissions on root\WebAdministration.
Members of the local Administrators group already have the required WMI permissions - these steps are only needed for non-administrator accounts.
2. Configure discovery rules to scan for dependencies
When adding or editing an Active Directory Discovery or Computer Discovery rule, a Dependencies section controls whether the scan looks for services, scheduled tasks, and IIS application pools running under the discovered accounts.
1
Open Account Discovery
Log in as a user with the administrative Privileged Accounts Management permission, click Account Discovery, and select the Rules tab.
2
Add or edit a rule
Click Add to create a new rule, or click an existing rule to edit it.
3
Select a supported rule type
Set Type to Active Directory Discovery or Computer Discovery.
4
Enable Dependencies
In the Dependencies section (below General), enable the Dependencies toggle.
5
Choose what to scan for
Select one or more:
Option
Discovers
Windows Services
Services running under the specified account.
Scheduled Tasks
Scheduled tasks configured under the specified account.
IIS Application Pools
IIS application pools configured under the specified account.
6
Save
Click Save.
The Dependencies section of a Discovery Rule.
If Dependencies is enabled but no checkboxes are selected when you click Save, the rule saves with Dependencies disabled. The section only appears for Active Directory Discovery and Computer Discovery - not for Linux Discovery rules.
3. View discovered accounts and their dependencies
After a discovery rule with dependency scanning runs, discovered accounts appear on the Privileged Accounts tab. The Active Directory and Windows Local sub-tabs each gain a Dependencies column showing how many dependencies were found per account.
Discovered gMSA accounts are marked with a dedicated icon in the Active Directory sub-tab. Hovering shows: “Group Managed Service Accounts (gMSA) are managed by Active Directory group policies and cannot be onboarded into Syteca.”
gMSA accounts can’t be onboarded - the Onboard icon is unavailable for them, and Bulk Action > Onboard is disabled if any gMSA account is selected. See Group Managed Service Accounts below.
The Dependencies tab on the Account Discovery page consolidates every dependency discovered across all rules, sorted by Discovered date (most recent first).
Column
Contents
Computer
The endpoint (hostname) where the dependency is located.
Type
Windows service, IIS Application Pool, or Scheduled Task.
Status
The dependency’s current operational status - see below.
Login
The login name of the account the dependency runs under.
Discovered
When the dependency was first discovered.
Last Onboarding Time
When the associated account was last onboarded.
Description
The name of the service, pool, or task.
Discovery Rule
The rule that discovered it. If found by multiple rules, shows only the most recently run one.
Secret
The secret created during onboarding for the associated account. Click the name to open it on Password Management.
Status couldn’t be checked (availability, permissions, or other errors), or the dependency failed to restart/stop.
Exposed
A new, previously unknown dependency was detected for an already-managed account.
Unknown
The most recent check couldn’t confirm current status (endpoint unavailable, insufficient permissions, network issues). Previously discovered, but unconfirmed now.
The Dependencies tab, with dependency statuses visible.
Hovering over a Status value shows “Last dependency check: <date and time>”, updated automatically. Dependency checks run after discovery, after onboarding, after each remote password rotation, and automatically every 3 hours.
Onboarding an AD or Windows local account that has dependencies shows a Dependencies section on the Properties tab of the Onboard Account popup.
1
Open Account Discovery
Log in as a user with the administrative Privileged Accounts Management permission, click Account Discovery, select Privileged Accounts, then the Active Directory or Windows Local sub-tab.
2
Start onboarding
Click the Unmanaged icon in the Status column for a single account, or select multiple and use Bulk Action > Onboard.
3
Complete the standard sections
On the Properties tab of Onboard Account, fill in General and Password Settings as usual.
4
Enable Dependencies
In the Dependencies section, enable the toggle.
5
Choose the post-rotation behavior
Option
Behavior after the password rotates
Restart dependencies after onboarding(default)
Updates credentials in each dependency, then restarts each service, task, or pool.
Stop dependencies after onboarding
Updates credentials in each dependency, then stops each service, task, or pool.
6
Select the rotation secret
Complete Account(s) for Rotation by selecting the secret to use for remote password rotation.
7
Onboard
Click Onboard.
Dependencies is disabled by default; Restart dependencies after onboarding is pre-selected once enabled. The section is unavailable if Use current password is selected under Password Settings, and doesn’t appear when onboarding Linux accounts. When onboarding a mix of accounts with and without dependencies via Bulk Action, the section still displays.
After onboarding an account with dependencies, its Dependencies tab appears on the Edit Secret page.
1
Open the secret
On Password Management, open the secret for the onboarded account.
2
Open the Dependencies tab
Select the Dependencies tab.
Column
Contents
Computer
The endpoint hostname.
Type
Dependency type, with a color-coded status label next to it (Running / Stopped / Failed / Exposed / Unknown - same meanings as above).
Description
The service, pool, or task name.
Hovering the status label shows “Last dependency check: <date and time>.” The grid paginates at 50 records per page (not configurable), newest entries first. Last dependency status check (below the grid) shows the most recent check time for this account’s dependencies.
6.1 Configure dependencies from the Automation tab
The Automation tab on Add/Edit Secret has its own Dependencies section - the same toggle and Restart/Stop after onboarding options - letting you change dependency handling for an already-onboarded account without repeating onboarding.
The Dependencies section on the Automation tab.
Only available for Active Directory and Windows local account secrets, since dependency management requires remote password rotation support. If Account Discovery hasn’t run for this account yet, the tab shows: “Account Discovery must be performed to detect dependencies for this account.”
When an account with dependencies is onboarded - or remote password rotation runs for an already-managed account with dependencies - Syteca follows a structured workflow.
7.2 Step 2: Reconciliation with a dedicated account
If Step 1 fails, Syteca automatically retries using the reconciliation account configured on Configuration → Account Discovery - typically a domain admin account.
Uses the first available reconciliation secret matching the account’s domain.
Success stops the process there; failure tries the next secret from the same domain.
Secrets from other domains aren’t used.
Only one reconciliation attempt per rotation cycle, with a 10-second timeout between retries.
The Tasks List task is marked Finished with errors, naming the failed dependencies (for example, “‘Windows Service1’, ‘Windows Service2’ dependencies failed to restart. Manual intervention required.”).
A System Health notification appears.
The affected dependency’s status changes to Failed.
Common causes: insufficient permissions, application failure on the endpoint, or insufficient CPU/RAM/memory. Errors are logged in the Tasks List, the Server log file, and the Onboarding log file.
If the account’s password rotates successfully but a dependency fails to restart/stop, the task shows Finished with errors (not Failed) - onboarding itself is considered complete; only the dependency update failed.
If Syteca detects a new dependency for an account already in Managed status, the account automatically becomes Exposed - meaning its credentials may now be used by an additional, unsecured service or process.When this happens:
The account gets a dedicated Exposed icon on the Privileged Accounts tab (tooltip: “New unmanaged dependency detected using this account.”).
The new dependency appears on the Dependencies tab with a warning icon.
An email notification goes to the user defined in the discovery rule that triggered detection.
On Password Management, open the secret for the affected account.
2
Open the Automation tab
Select the Automation tab.
3
Enable Dependencies and choose behavior
Enable the Dependencies toggle and select Restart dependencies after onboarding or Stop dependencies after onboarding.
4
Rotate
Click Rotate Now for an immediate rotation, then Save - or just click Save and wait for the next scheduled rotation.
During rotation, Syteca rotates the Exposed account’s password, all known dependency passwords, and all newly discovered dependency passwords. On success, the status returns to Managed and the warning icon clears.
gMSA accounts are Active Directory accounts whose passwords Active Directory group policies manage automatically. Syteca can discover gMSA accounts (in the Domain Admins or Enterprise Admins groups) and their dependencies during Active Directory Discovery scans.Discovered gMSA accounts appear on the Active Directory sub-tab with a dedicated icon. Restrictions:
Can’t be onboarded through standard onboarding - the Onboard icon is unavailable, with tooltip “Group Managed Service Accounts (gMSA) cannot be onboarded. These accounts are stored as read-only.”
Bulk Action > Onboard is disabled if any gMSA account is selected (alone or with regular AD accounts).
gMSA accounts can be skipped via Bulk Action > Skip.
Their dependencies still appear on the Dependencies tab.
Upgrading to a version with Service Account Discovery doesn’t automatically populate dependency information for accounts discovered before the upgrade.
1
Re-run discovery rules
Configure discovery rules as described in Prerequisites and Configure discovery rules, then run them again from the beginning to detect dependencies for existing accounts.
After the upgrade, when rules run:
If discovery finds dependencies for an account already Managed, that account automatically becomes Exposed.
New dependencies appear on the Dependencies tab with a warning icon.
To return the account to Managed, perform a remote password rotation for its secret with Dependencies enabled - see Resolve the Exposed status.
