Active Directory
Overview
Britive integrates with Active Directory through the Britive Access Broker, enabling just-in-time (JIT) access to AD groups, admin accounts, and service account credentials. The guides here cover common use cases with working example scripts that you can adapt to your environment.
The Access Broker
The Britive Access Broker is the core component for this integration. It runs as a Windows service — preferably on a domain-joined machine — and communicates with your AD environment on Britive’s behalf using a least-privilege service account.
We recommend using a gMSA for this purpose.
Brokers are deployed in pools and can manage multiple resource types from a single deployment.
In This Section
- Getting Started
Install and configure the Britive Access Broker on a domain-joined Windows VM using a gMSA service account to manage JIT access in Active Directory.
- Manage Group Memberships
Grant and revoke JIT Active Directory group membership using the Britive Access Broker — covers single group and dedicated admin (-a) account patterns.
- Rotate Admin Accounts
Use the Britive Access Broker to rotate passwords for dedicated AD admin accounts (-a accounts) at checkout and re-rotate at checkin to eliminate standing credentials.
- Rotate Service Accounts
Use the Britive Access Broker to rotate AD service account passwords on a schedule or at checkout — optionally updating the Windows service credential on the remote host via WinRM.
- Scan Active Directory
Run an IAM-style broker scan to sync Active Directory users and groups into Britive Resource Manager — enabling JIT access policies against real AD principals.