When a CPM plugin fails during a specific phase like ‘change’, the most targeted approach is to enable debug logging for the CPM. This provides a step-by-step transaction log of the plugin’s actions, revealing the exact command or interaction that triggers the ‘access denied’ error, which is often a specific sequence or timing issue not caught by basic permission checks.

The ‘List’ permission is foundational. It allows a user to see the Safe in the PVWA interface and view the objects (accounts, files, etc.) it contains, along with their metadata (name, address, last change, etc.). Without ‘List’, the Safe is essentially invisible to the user. It does not, by itself, grant the ability to retrieve credentials (‘Retrieve’) or manage content (‘Add’).

A ‘Dual Control Access Request’ is designed for exactly this scenario. It enforces the principle of least privilege and compliance by providing one-time, monitored, and approved access without permanently altering Safe memberships. The requester initiates it, an authorized approver grants it, and the access is logged and automatically revoked after use or expiration, maintaining a full audit trail.

Using a wildcard (‘*’) for the Logon Domain means any user with ‘Retrieve’ permissions for that account can use the credential to log on to *any* domain where the username is valid. This violates the principle of least privilege. A user who should only access a test domain resource could potentially retrieve the password and use it to access a production domain, creating a significant privilege escalation risk.

For PSM to proxy a specific protocol like SSH, the corresponding background service (e.g., PSMForSSH) must be installed and running on the PSM server. If this service is stopped or not installed, the PSM cannot establish the proxy session for that protocol, resulting in immediate termination. Checking service status is a fundamental first troubleshooting step for PSM connectivity issues.

The ‘Verify Passwords’ process attempts to log on to the target system with the managed credential. If this fails, it can indicate issues beyond an incorrect password, such as an account being locked, expired, or disabled. This proactive check provides early warning of account status problems before they cause an application outage, allowing for remedial action.

This setting defines the scope of the CPM’s management authority. An ‘Unrestricted’ CPM user can manage accounts in all Safes that have that CPM assigned, which is typical for a primary CPM. A ‘Restricted’ CPM user is explicitly tied to one or more specific Safes, a useful configuration for segregating duties (e.g., a dedicated CPM for a high-security environment).

To enable recording for a specific protocol like SSH, you must ensure: 1) The correct protocol-specific connector (PSM for SSH) is installed on the PSM server, and 2) The corresponding PSM Policy (e.g., PSM-SSH) is properly configured and assigned to the target platform. The policy defines the recording parameters (video, text, keystrokes) for sessions using that connector.

Even if an administrative service account has the delegated permissions to change another user’s password, the target account itself might have the ‘User cannot change password’ attribute set. This attribute takes precedence and will block the change attempt, resulting in an Access Denied error. This is a common AD-specific nuance that must be verified when troubleshooting CPM failures on Windows platforms.

When a CPM plugin fails during a specific phase like ‘change’, the most targeted approach is to enable debug logging for the CPM. This provides a step-by-step transaction log of the plugin’s actions, revealing the exact command or interaction that triggers the ‘access denied’ error, which is often a specific sequence or timing issue not caught by basic permission checks.0