Preparing Your Network for the Active Directory Agent

Set up your network and install the Active Directory agent to synchronize users, groups, and organizational data into Forcepoint Data Security Cloud.

The LDAPS integration synchronizes your users, groups, departments, organizational units (OUs), and computers from Active Directory into the Data Security Cloud Platform. The agent-based method installs a lightweight connector inside your network that connects outbound to Forcepoint — your directory remains internal and does not require internet exposure.
Note: Choose the agent method when you need to keep your directory internal without exposing your LDAPS endpoint to the internet.

How the Agent connects

A Forcepoint agent runs inside your network and establishes a persistent outbound secure websocket connection to Forcepoint. No inbound firewall rules or IP allow-lists are required — all connectivity is outbound-only, which minimizes your attack surface.

Information to Gather Before You Start

Have the following information ready before beginning installation:
S Information Example / Notes
1 Directory type Active Directory, OpenLDAP, or other LDAP-compliant directory
2 Connection URL (protocol + host + port) ldaps://ldap.clientdomain.com:636
3 Base DN dc=clientdomain,dc=com — defines the scope of users and groups to sync
4 Bind DN (service account) cn=svc-idmsync,ou=ServiceAccounts,dc=clientdomain,dc=com — dedicated, read-only account
5 Bind password Credentials for the service account — store securely
6 CA / SSL certificate (PEM) .pem file — required for LDAPS or StartTLS
7 Agent host Windows host with network access to your directory and outbound internet connectivity
8 Technical contact Name and email for setup coordination
Note: Use a dedicated, read-only service account for the Bind DN — not an admin or personal login. Grant read access only across your Base DN.

Network Prerequisites

Prerequisite Details
Agent Host Windows host with network line-of-sight to your Active Directory domain controllers and outbound internet access (no inbound ports required)
Outbound Connectivity: Agent → Forcepoint Persistent WSS connection to endpoint in config.json over HTTPS/WSS (typically TCP 443). Firewall must allow outbound traffic to this URL. Configure proxy if network requires it.
Directory Connectivity: Agent → Directory Host must reach directory over LDAPS (TCP 636) or equivalent encrypted LDAP port
Service Account (Bind DN) Dedicated, read-only account scoped to Base DN. Plan for periodic password rotation and update LDAPS profile when credentials change.
SSL/TLS Certificate CA certificate (PEM format) for LDAPS/StartTLS connection validation
Handling config.json Treat as credential — do not email or commit to source control; delete stray copies after installation; if exposed, remove agent and create new one to rotate the secret

Install the Agent

After preparing your network and configuring the LDAPS profile, install the agent on the Windows host. For detailed installation steps, see Configuring agent.

Once the agent is installed and shows an active connection status, proceed to initiate synchronization.

Initiate Synchronization

After the agent connects successfully, initiate a full sync to bring in existing users, groups, and organizational units from your directory. See the following topics for details:

Verify the Agent is working
Check Where to Look Expected Result
Agent connected Agent host console output Successfully made websocket connection to Platform
Agent registered Admin > LDAPS > Agent List IsActive = green check mark
Objects synced Users / Groups pages Directory users and groups appear after full sync
Sync healthy Collect Logs > LDAPS Sync Logs Sync completes without errors