Context

When using domain credentials (e.g., MYDOMAIN\Administrator) to rotate a local account password on a member server, the verification step was failing with "Authentication failed" because it tried to authenticate the rotated local account using the domain from the app connection configuration.

Local accounts exist in the machine's local SAM database, not in Active Directory. Attempting to authenticate MYDOMAIN\localuser would fail because localuser doesn't exist in AD.

Screenshots

Steps to verify the change

Test Environment Setup

1. Set up AWS test environment with two Windows servers:

   • EC2 - 1 (Domain Controller): Windows Server with Active Directory configured (e.g., TESTDOMAIN.local)
   • EC2 - 2 (Member Server): Windows Server joined to the domain, with a local account created (e.g., testuser)

2. Create local account on member server (EC2 - 2):

   New-LocalUser -Name "testuser" -Password (ConvertTo-SecureString "InitialP@ss123!" -AsPlainText -Force) -PasswordNeverExpires
   # Add to Administrators group for Login as Target method
   Add-LocalGroupMember -Group "Administrators" -Member "testuser"

3. Ensure security groups allow SMB (port 445) between Infisical and the member server

Test Case 1: Login as Root (Domain Admin rotates local account)

1. Configure SMB Connection:

   • Host: Member server private IP (EC2 - 2)
   • Port: 445
   • Domain: TESTDOMAIN
   • Username: Administrator (domain admin)
   • Password: Domain admin password

2. Create Windows Local Account Rotation:

   • Target Username: testuser
   • Method: Login as Root

3. Trigger rotation and verify it succeeds

Test Case 2: Login as Target (Local account rotates itself)

1. Configure SMB Connection:

   • Host: Member server private IP (EC2 - 2)
   • Port: 445
   • Domain: Leave empty (local account)
   • Username: testuser
   • Password: Current password of testuser

2. Create Windows Local Account Rotation:

   • Target Username: testuser
   • Method: Login as Target
   • Current Password: Current password of testuser

3. Trigger rotation and verify it succeeds

Type

• Fix
• Feature
• Improvement
• Breaking
• Docs
• Chore

Checklist

• Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
• Tested locally
• Updated docs (if needed)
• Read the contributing guide