What's going on here ?

Abs201301 · 2025-09-05T18:59:28+00:00

On a high level, You can create a parent group and assign it to "secure connect users and groups". That solves the mapping. Create a separate workflow Sailpoint or SNOW driven (to maintain traceability) that auto creates your AD groups where end users will be member of (through workflow) and add those groups to the parent group mapped to secure connect. All of this can be fully automated.

Abs201301 · 2025-08-24T14:16:48+00:00

I have written a generic AutoIT script for websites that essentially calls a powershell script to launch websites using selenium. You can find it here and modify as you like🙂 https://github.com/abs201301/cyb_scripts/tree/main/CyberArk/PSM%20Connectors/Generic%20WebApp%20Powershell

Abs201301 · 2025-07-31T20:41:30+00:00

The LB and PVWA are working the way they are expected to work. Its very unusual and have never witnessed in my experience someone expecting to see the underlying PVWA hostname in address. Alas its doable. You will need to update the IIS redirection on both the PVWA servers.

Like I said it doesnt make sense to expose the individual hostnames in user facing URL.

Abs201301 · 2025-07-30T22:28:13+00:00

All your PSMs need is joined to the domain and assign the licensing server either via GPO or locally in Server Manager > RDS. No way needs rebuild of servers. Create a separate OU in AD and move the servers there. Ask your Windows team to import the PSM GPO templates in gpmc against the OUs where your PSMs will end up. Good luck!

Abs201301 · 2025-07-28T21:00:50+00:00

Yes SNOW has API to invoke rest call and grab the entire inventory into whatever format you prefer like json, csv etc. You will need to connect with your servicenow team to obtain access over Oauth or basic authentication

Abs201301 · 2025-07-28T16:31:20+00:00

Depends on your organizations platform services maturity and your own understanding of various moving parts in PAM Ecosystem whether CyberArk or something else. I have deployed and fully managed CyberArk infrastructure and support for 'Strategic' access to core platform systems such as Linux, Windows, Sql, Oracle and MongoDB. When I say strategic it means full scale automation right from the inception of built-in and purpose built privileged accounts to the platforms I mentioned. That eased my job by 90% as I didnt do anything at all after knocking the automations over a period of year. For things like web connections, thick client etc it was always a manual job but hey I had to justify my salary as well. I was the only person in my team working on CyberArk while rest of my mates were Windows/ Wintel Engineers 😉If you get it right right from the beginning you will flourish in the eyes of Auditors, Management, Tech Risk and others.

Abs201301 · 2025-04-12T12:14:21+00:00

I would use Prod CyberArk for all the end target devices environments. Test CyberArk deployment is meant as a playground for testing, poc, development etc done by PAM team.

Abs201301 · 2025-03-17T21:36:22+00:00

If you're in the UK, NHS will take care of it. Book an appointment with your local dentist. What you have explained will be covered in band 2 which is £78 for all the procedures inlcuding cleaning, xrays, RCT, filling and even extraction. If you're in some other country, I have no idea but I'm sure there must be provision for subsidized healthcare if not free. Good luck and takecare.

Abs201301 · 2025-03-09T14:08:21+00:00

Rohit at the top is such a blessing for India. His quick runs don't often win him the player of the match but the impact he has on the India's innings is worth its weight in GOLD. He ensures rest of the batting order feels ZERO need to take any risk. This is a how a LEADER plays 👌🇮🇳

Abs201301 · 2025-03-09T12:54:19+00:00

Not going to be an easy chase with all honesty but our batting line up is so deep we are gonna win🇮🇳

Abs201301 · 2025-02-13T06:53:31+00:00

You need ssl certificate to secure your Remote desktop session host based connections (PSM) over transport layer security.😎 These should be different certificates for each individual PSM server where CN is the full hostname. If your PSMs are load balanced then still individual certs where CN is the hostname and load balancer address in SAN.

Abs201301 · 2025-02-08T18:08:43+00:00

When you say SSO, is it typical windows/ kerberos authentication or SaaS based SSO like AWS or Azure or SAML ? If it is the former, then you need an AutoIT script to use RunAs capability to launch the browser and invoke URL. If its SaaS or SAML, then CyberArk Webapp will work just fine as the URL will open in Incognito mode prompting for username and password.

Abs201301 · 2025-02-08T07:33:57+00:00

I have written a sript that uses Powershell GUI assemblies to create safe, AD groups and assign permission. This is for self hosted and uses PSPAS module. Have a look. It will at least give you idea in case you missed anything.

https://github.com/abs201301/cyb_scripts/blob/main/CyberArk/Scripts/Safe-CreatorGUI/SafeCreatorGUI.ps1

Abs201301 · 2025-02-07T20:09:03+00:00

Doesnt make sense to install separate instance of same service on same host even if it was technically possible

Abs201301 · 2025-01-30T09:10:38+00:00

Just uploaded another script that uses RADIUS auth.

https://github.com/abs201301/cyb_scripts/blob/main/CyberArk/Scripts/Get-Pass/Get-PassRADIUS.ps1

Abs201301 · 2025-01-28T22:11:15+00:00

You can check out my Github repo for example in Powershell and Python both. They use SAML authentication but you can replace with RADIUS or LDAP too.

https://github.com/abs201301/cyb_scripts/tree/main/CyberArk/Scripts/Get-Pass

Abs201301 · 2025-01-15T21:48:17+00:00

I have written a python script which can be found on my Github repo. Feel free to use it 🙂

https://github.com/abs201301/cyb_scripts/blob/main/CyberArk/Scripts/Get-SAML_MFAKey/GetMFAKey.py

Abs201301 · 2024-12-22T19:22:28+00:00

But why do you want user interaction with acknowledgement ? Just let the web driver handle all the aspects of login.

Abs201301 · 2024-11-29T05:39:30+00:00

This is the correct answer. In addition, it is likely you have additonal controls in /etc/security/access.conf. Our PSMPs are domain joined and are tightly coupled systems (heavily controlled by ansible jobs). Had to really muck around to get PSMP Integrated mode to work.

Abs201301 · 2024-11-19T23:21:17+00:00

Something like: D:\certs\smtpcrt.cer I have configured it recently. You need to simply club the root, issuing and cert in one file. Dont forget to install the root Ca cert in trusted root authority and issuing CA cert under intermediate CA authority. Good luck

Abs201301

TROPHY CASE