Skip to content

Getting started

InfraSOS AD Command manages the deployment, health and security of a Microsoft Active Directory domain running on AWS. It installs on a Windows Server instance and is administered from a browser.

What you need

  • A Windows Server 2019, 2022 or 2025 instance in the VPC where the domain will live.
  • An account in the local Administrators group on that instance, or a Domain Admin once the instance is a domain controller.
  • Network access to the instance on port 8443 from wherever you administer it.

The product needs no AWS access keys and calls no AWS API. It reads the instance's own metadata to describe where it is running, and nothing else.

Opening the console

Browse to https://<instance>:8443.

The certificate is generated by the product on first start and is not signed by an authority your browser trusts, so it will warn you. That is expected on a private management endpoint. If you would rather not click through the warning, the recommended route is an AWS Systems Manager Session Manager port forward, which also avoids exposing 8443 at all:

aws ssm start-session --target <instance-id> \
  --document-name AWS-StartPortForwardingSession \
  --parameters "portNumber=8443,localPortNumber=8443"

Then browse to https://localhost:8443.

You sign in with Windows Integrated Authentication - the account you are already using. There is no separate product password to manage, and none to leak.

The first screen

Before the instance is a domain controller, most of the console reports "Not joined". That is a normal state, not a fault: the product installs before promotion so it can run the deployment for you.

Go to Deployment to create a new forest or promote this instance into an existing domain.

After promotion

The dashboard fills in: domain health, replication, the security assessment and recent directory changes. The security assessment runs automatically once a day from then on, so the score and its history stay current without anybody signing in.