> For the complete documentation index, see [llms.txt](https://documentation.2pintsoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.2pintsoftware.com/deployr/deployr-enterprise/securing/windows-authentication.md).

# Windows authentication

You can use the following group types for authentication:

* Local Groups (on the DeployR Server)
  * Nested with Local Users, AD groups, AD users
* Active Directory Groups \[from the AD the DeployR server is joined to]
  * Nested with AD groups, AD users

### Enabling in Config Editor

In the **Security Settings** section of the DeployR Config Editor, enable **Windows authentication**. Then specify either a local Windows group on the DeployR server or an Active Directory group. By default, it will use the local **administrators** group on the DeployR server.

{% hint style="info" %}
In the Config Editor, enter the exact Windows group name. Do not include a domain prefix.
{% endhint %}

### Example: Configure with Active Directory Group

In Active Directory, another group called **DeployR WinPE Auth** was created. (In hindsight, "DeployR OSD Auth" would have been a more accurate name.) Members of this group can authenticate to the DeployR OSD process. Currently there are 4 user accounts in the **DeployR WinPE Auth** group, including the user **DeployR OSD** with a login name of **DROSD.**

Add the exact name from your AD group into the field:

<figure><img src="https://content.gitbook.com/content/8m0VARX9oyZ2zXWCdPgr/blobs/zfvpObwQjt9UuYFY2FAm/image.png" alt=""><figcaption></figcaption></figure>

Users who belong to this group will now be able to authenticate:

<figure><img src="https://content.gitbook.com/content/8m0VARX9oyZ2zXWCdPgr/blobs/KELTbyfLfrdsEZOjFIEE/image.png" alt=""><figcaption></figcaption></figure>

### Example: Configure with Local group & nested AD groups

This is handy when additional accounts need to be created for technicians and the DeployR server is not part of Active Directory, or when you want to add accounts for OSD only that do not have rights in Active Directory.

A local group can be created and populated with local user accounts, Active Directory users and groups, or both, so a mix of local and AD accounts can all authenticate the task sequence process.

In this example, a new local group called **DeployROSDAuth** has been created on the local DeployR server, which has been populated with an AD group and two local accounts. The local group is set in the Config Editor:

<figure><img src="https://content.gitbook.com/content/8m0VARX9oyZ2zXWCdPgr/blobs/B7vkVIsISc7sKwffMyvV/image.png" alt=""><figcaption></figcaption></figure>

Now that the group is set, any account in the group **DeployROSDAuth**, directly or through nesting, will have rights to authenticate the task sequence:

<figure><img src="https://content.gitbook.com/content/8m0VARX9oyZ2zXWCdPgr/blobs/n00dyMRVaJNaa21UfTO5/image.png" alt=""><figcaption></figcaption></figure>

### Task Sequence Variables | Reporting

When using authentication, once authenticated into the task sequence, the user is captured into a variable which can be used in your task sequence, or just used later to look up who ran the task sequence:

<figure><img src="https://content.gitbook.com/content/8m0VARX9oyZ2zXWCdPgr/blobs/HAjAEIltNbRPbKWMB9wr/image.png" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://documentation.2pintsoftware.com/deployr/deployr-enterprise/securing/windows-authentication.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.