The ‘Static File’ feature in a Connection Component is designed specifically for this purpose. It allows you to centrally upload and manage files (like key files or certificates) required for a connection. The file is securely stored in the Vault and can be referenced in the connection command, promoting reusability, security, and easier updates compared to hardcoding paths or misusing password fields.

To verify or change a password on a Windows machine, the CPM service account requires the powerful ‘Act as part of the operating system’ (SeTcbPrivilege) privilege on that specific target machine. This is a common prerequisite often missed during initial deployment or when onboarding new systems. The other options involve restrictions that would typically cause different, more specific errors.

Error 1302 in a database context typically translates to ‘Insufficient privilege’ or ‘Access denied.’ The most direct cause is that the reconciliation account (the account the CPM uses to perform the password change) lacks the specific database privilege required, such as ALTER USER. Starting the investigation here addresses the core permission issue before moving to network, plugin configuration, or policy mode settings.

The PVWA Reporting module is the standard, supported interface for generating audit reports. The ‘All Activities’ report captures login/session start events. It can be filtered by multiple criteria, including the target account (e.g., root accounts) and the user’s group (e.g., a ‘Contractors’ group), providing an accurate, auditable report without needing direct database access or external SIEM filtering.

This scenario is a classic use case for a Dependent Account. The technical admin account (the parent) is used to perform an action—in this case, generating a new API token (the dependent). A custom CPM plugin can be developed to automate the entire rotation workflow: using the parent credentials via the API to generate a new token and then updating the dependent account. This keeps the process secure, automated, and within the CyberArk audit trail.

The ‘PasteAsKeystrokesDelay’ parameter controls the delay between simulated keystrokes when pasting multi-line text. If this value is too low or misconfigured, especially after an upgrade, the PSM may not correctly transmit line breaks or may send lines too quickly for the target shell, causing commands to run incorrectly or not at all. Adjusting this parameter is the standard fix for multi-line paste issues in PSM-SSH.

A time-limited password release policy (also known as a ‘checkout’ policy) is designed for this exact scenario. It allows authorized users to retrieve the password without manual approval, but the password is automatically reconciled (changed) after the defined period (e.g., 4 hours). This provides automated, just-in-time access with a hard stop. Pairing this with PSM would add session recording, but the core access and revocation mechanism is the time-limited release.

The ‘Number of concurrent connections’ platform property controls how many accounts of that platform the CPM will process in parallel. If this is set to 1 (the default for many custom platforms), the CPM will change passwords sequentially, leading to long total cycle times for large account sets. Increasing this value (within the limits of the target system’s capacity) is the primary method for reducing the overall duration of a mass password change operation.

The PSM connector configuration file (e.g., ApplicationName.psm) contains the recording rules. These rules use window titles, process names, or classes to define which application windows should be included or excluded from the recording. To capture a specific pop-up, you must ensure its window properties are correctly identified and included in the ‘RecordingRules’ section of this configuration file.

The ‘Static File’ feature in a Connection Component is designed specifically for this purpose. It allows you to centrally upload and manage files (like key files or certificates) required for a connection. The file is securely stored in the Vault and can be referenced in the connection command, promoting reusability, security, and easier updates compared to hardcoding paths or misusing password fields.0