# Integrating SailPoint with Windows Local

Use the Windows Local connector to manage Windows Local user accounts. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a Windows Local connector. After it is successfully configured, your organization can aggregate and provision accounts for Windows Local users.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site.

The Windows Local connector supports the following features.

### Account Management

- Aggregate and refresh Windows Local users as accounts
- Add or remove entitlements
- Add or remove Windows Local groups to non-local (domain) users. See [Advanced Settings](<https://documentation.sailpoint.com/connectors/windows_local/va/help/connecting.html#advanced-settings>) for configuration.
- \*Password Management
- \*Provision Accounts

  - Create, update, delete
  - Enable, disable, unlock, and change password

### Entitlement Management

- \*Access Certifications (certification of entitlements connected to accounts)

### Permission Management

- Execute native before/after scripts for provisioning requests

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

### Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

## Supported Versions

The Windows Local connector supports the following versions of Microsoft Windows.

- Microsoft Windows Server 2022
- Microsoft Windows Server 2019
- Microsoft Windows Server 2016

## Prerequisites

- IQService must be installed on the Windows system. Follow the instructions in the [IQService Administrator's Guide](<https://documentation.sailpoint.com/connectors/iqservice/help/index.html>) to install IQService. For more information, refer to [Installing and Configuring IQService](<https://documentation.sailpoint.com/connectors/windows_local/va/help/iqservice/install_config_iqservice.html>).

  > **Important**
  >
  > IQService installation now enforces TLS configuration by default to improve security and safeguard your environment. To proceed with the installation, ensure you have completed the necessary prerequisites for TLS configuration. For more information, refer to [Configuring TLS and Client Authentication for IQService](<https://documentation.sailpoint.com/connectors/windows_local/va/help/iqservice/configuring_tls_and_client_authentication_for_iqservice.html>).
- Start the remote registry service on the managed system.
- Allow an exception for **File and Printer Sharing** in the Windows firewall.
- Configure at least one virtual appliance cluster and successfully test the connection. For more information, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Ensure that the account being used to configure the connection has Administrator privileges on the Windows host machine.
- Deselect **Disable NonLocal Lookup** and **Disable Qualifying Local Objects** before running the account aggregation to provision the non-local (domain) users. For more information, refer to [Advanced Settings](<https://documentation.sailpoint.com/connectors/windows_local/va/help/connecting.html#advanced-settings>).

  > **Note**
  >
  > To view non-local (domain) users `userName` in the format of "domainName\\saMAccountName", deselect **Disable Qualifying Local Objects** before running the account aggregation. For example, `domainName\TestUser1`.

## Administrator Permissions

The service user account should be a member of the **Administrators** group on the managed Windows host computer.