> ## Documentation Index
> Fetch the complete documentation index at: https://docs.idemeum.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Computer account types

> Choose the account types to use when technicians access customer workstations.

## Named vs. shared accounts

<Warning>
  All compliance frameworks require administrative access to be performed with individual admin accounts that can be audited.
</Warning>

<AccordionGroup>
  <Accordion title="Named admin accounts" defaultOpen icon="user-check">
    <Info>
      Named accounts is the default option.
    </Info>

    When technicians login, an individual account for their assigned username is create on the workstation (or domain controller). Each account is enabled only for the duration of the session and the password is rotated to a random value after each log out. In the audit logs you will see information about who logged in where and what individual account was used.
  </Accordion>

  <Accordion title="Shared admin account" defaultOpen icon="share">
    We offer this option to reduce the number of accounts created, however this option does not pass security and compliance requirements. One individual account is used to login all technicians. This account is enabled only for the duration of the session, and password is rotated behind the scenes for after every log out. Agent automatically generates in the account in the form msp-XXXX (i.e msp-1234) for each customer / organization. In the logs you still have visibility into show logged in where with the shared account.
  </Accordion>
</AccordionGroup>

## Domain vs. local admin accounts

<AccordionGroup>
  <Accordion title="Local admin accounts" defaultOpen icon="credit-card-blank">
    <Info>
      Local admin account is the default option.
    </Info>

    Regardless of the computer state (local, domain, or Entra joined) idemeum will create local admin account for each technician. For the case there is no need to install idemeum agent on domain controller. Simply install on user workstations.
  </Accordion>

  <Accordion title="Domain admin accounts" defaultOpen icon="star">
    <Note>
      You need to install idemeum agent on all domain controllers to be able to create and use JIT domain accounts.
    </Note>

    When technician tries to login by scanning a QR-code on user workstation, idemeum agent reaches out to DC to provision and enable domain account. After the session domain account is disabled and the password is rotated.
  </Accordion>
</AccordionGroup>