Active Directory Query eXecutor

Last Updated: September 11, 2026

The Active Directory Query eXecutor (ADQX) is a PrinterLogic Service Agent service that enables on-demand querying of a customer's on-premise Active Directory (AD) server without requiring firewall port exposure. ADQX uses a WebSocket connection to communicate with PrinterLogic, eliminating the need to open Lightweight Directory Access Protocol (LDAP) ports in your network perimeter.

Key Points

  • This feature is only available upon request, reach out to your Vasion representative for more details.
  • The Service Agent communicates outbound via WebSocket.
  • ADQX executes a limited, predefined set of AD queries, it does not have open-ended access to your directory.
  • ADQX supports asynchronous operations, including workflow processing that requires AD data at runtime.
  • All queries executed by ADQX are visible to admins in the PrinterLogic Admin Console, providing full transparency into directory activity.
  • With Use machine credentials (Windows SSPI) for this domain enabled, this Service Agent uses its Windows domain account (SSPI) to bind to this Active Directory domain instead of the stored username and password. Only supported on Windows Service Agents that are joined to this domain.
  • When ADQX is enabled, the Test Settings button on the LDAP Settings page is unavailable. Use the Ping and Bind buttons on the ADQX tab of the Service Agent to verify your connection and credentials.

How ADQX Works

When PrinterLogic needs to query your on-premise Active Directory to process a workflow or authenticate users, it sends a request to the ADQX Service Agent installed in your environment. ADQX receives the request over an outbound WebSocket connection, executes the appropriate query against your local AD server, and returns the result to PrinterLogic in a structured format.

The set of queries ADQX can execute is limited and defined by Vasion, ensuring your directory is not exposed to arbitrary lookups.

Administrators can review all queries ADQX can execute from the Admin Console.

ADQX currently authenticates users to the Admin Console who have migrated to the Unified Login (UL). Support for the Self-service Portal and mobile app is planned for a future release.

Review the following two scenarios to understand how ADQX and your LDAP Domain connection work together after you migrate to UL:

  • Port 636 open to external traffic: ADQX authenticates Admin Console logins. The Self-service Portal, mobile app, and Agent continue to authenticate through your existing direct LDAP connection on port 636, and these flows are not disrupted.
  • Port 636 closed to external traffic: ADQX authenticates Admin Console logins. The Agent is not affected, because it already resides on your network and authenticates directly without external firewall access. The Self-service Portal and mobile app have no alternative authentication path, so users cannot authenticate to those services with Active Directory credentials until Vasion releases ADQX support for them.

If your users authenticate to the Self-service Portal or mobile app with Active Directory credentials, keep port 636 open until the future release.

Requirements

  • Administrator access to your PrinterLogic Admin Console.
  • An LDAP Domain configured for your environment.
  • A Service Agent device running the ADQX service.
  • The Service Agent requires network access to your on-premis Active Directory server.
  • The Service Agent must be able to establish an outbound WebSocket connection to PrinterLogic.
    • No inbound firewall ports are required.

Next Steps