Hi Martyn,
There is a credential provider for Windows, but you can’t replace AD with it. There are policies coming from AD which are not in OpenIAM.
You can use the Windows Local connector to provision/deprovision access to Window client. If the connector is remote, then you should enable WinRM on the client machine.