Connection Components are designed precisely for this scenario. They allow you to define complex, reusable connection command strings (like those with specific parameters) separately from the platform. This maintains security by keeping credentials managed by CyberArk while providing the flexibility needed for real-world application connections, making it both secure and manageable.

To successfully change a local administrator password on a Windows machine, the account performing the change (the CPM service account) needs the specific ‘Reset password’ user right assignment on the target system. ‘Log on as a batch job’ is for authentication, but not sufficient for privilege escalation to reset another user’s password. This is a common configuration oversight in PAM deployments.

On-Demand Privileges (ODP) is designed for this exact use case. It provides just-in-time, ephemeral access. The ODP session manages the checkout of the SSH key, and the Connection Policy can be configured with an ‘End Session’ action (e.g., after inactivity or total time) to guarantee the session is terminated and the credential is checked back in automatically, enforcing the principle of least privilege with time bounds.

CyberArk’s Dual Control (Split Password) feature is the direct implementation of the dual control security principle. It physically splits the password into two parts, each retrievable by a different authorized user. This ensures no single person has the complete credential, enforcing checks and balances even during emergency access.

For non-standard applications, the ‘Custom Integration’ hooks (like Pre-Change, Post-Change, and Post-Verify scripts) are essential. A Post-Verify script can be written to call the application’s API, parse the unique confirmation code from the response, and interpret it to return a definitive success or failure status to the CPM, enabling reliable automated management.

PSM session behavior is primarily controlled at the platform and connection component level. The ‘Session Timeout’ setting within the PSM connection configuration for the specific platform (e.g., SSH) dictates how long an inactive session is allowed to live before PSM terminates it. This is the key setting to modify to align with user workflows while maintaining security policies.

The ‘Prevent password recycling’ feature in a CPM policy is designed to interact with systems that enforce password history. When enabled and configured with the correct history depth (e.g., 5), the CPM’s algorithm will avoid generating new passwords that match any in the device’s history list, preventing this specific failure mode.

The PSM Session Monitoring feature is purpose-built for this. It allows you to create roles (Viewers) that have permission to watch live or recorded sessions *without* having access to the underlying credentials or the ability to initiate sessions. This provides controlled, audit-compliant access to session forensics without exposing privileged credentials.

Using the Fully Qualified Domain Name (FQDN) is the most reliable method in a multi-domain environment. It ensures unambiguous name resolution across DNS zones, avoiding issues that can arise with NetBIOS names (which may rely on WINS or NetBIOS broadcast) or single-label names. IP addresses, while unique, are less manageable and can change.

Connection Components are designed precisely for this scenario. They allow you to define complex, reusable connection command strings (like those with specific parameters) separately from the platform. This maintains security by keeping credentials managed by CyberArk while providing the flexibility needed for real-world application connections, making it both secure and manageable.0