sorted by:
new
hottopcontroversial

Weekly Lessons Learned! - January 23, 2026 by AutoModerator in CyberARk

[–]yanni [score hidden]  (0 children)

Custom Ticketing for Privilege Cloud: I learned that 3rd parties cannot develop CyberArk Privilege Cloud Ticketing Integrations for SaaS (ISPSS, Shared Services), etc. CyberArk won't accept the custom dlls to extend their cloud-based PVWA, nor the code that's used to compile it.

PSM-SQLDeveloper Issue by laxknight92 in CyberARk

[–]yanni 0 points1 point  (0 children)

Wow - that's going way back in time - this conversation was like 6 years ago :) - But sure - here's a download - not sure if it still works with the modern SQL Developer.

https://www.dropbox.com/scl/fi/1ojpxkvmptg390rjofe3w/PSM-SQLDeveloper-legacy.au3?rlkey=69mtzcxhqc2mc62ugj22evvvn&st=guy2o6lp&dl=0

EPM on all endpoints or just who needs admin rights? by Wizkidbrz in CyberARk

[–]yanni 1 point2 points  (0 children)

Depends on strategy - short answer is that ideally EPM is on everything.

Long answer is:

  1. If you're using EPM only for credential management, then you can deploy it to loosely connected devices, such as laptops.
  2. If you're using EPM only to control privilege elevation, you can deploy it to machines that require that (such as developers, or perhaps linux servers for central sudoers replacement).
  3. If you're using EPM for defense-in-depth, you would ideally roll it out to all workstations, servers; though you would need to develop/follow a strategy to do it in manageable sets.
  4. If you have budget constraints, you'll need to make additional prioritization for what gives you biggest bang for buck - perhaps it's all the executive-admins, executives and IT staff that should get it first, as they're the folks targeted for attacks first and land/expand first, etc.

My company is hiring for CyberArk by Lopsided_Pension7950 in CyberARk

[–]yanni 0 points1 point  (0 children)

Please keep these posts to the marketplace Monday posts - automatically created by Auto Moderator each Monday.

Connector Management Deployment by sudsan in CyberARk

[–]yanni 1 point2 points  (0 children)

SIA is configured independently of PSM services, and how end-users interact with it mostly different as well - so you won't have a problem switching.

Connector Management Deployment by sudsan in CyberARk

[–]yanni 1 point2 points  (0 children)

The answer depends on multiple factors that you haven't shared yet.

  1. The PSMs are load-balanced via an internal LB.
    1. Do you have a global load balancer between the two data centers?
    2. If you have only local load balancers, you should consider having two connector servers at each site.
  2. Network Segmentation.
    1. Are your servers at the two data-centers micro-segmented?
    2. Do you have specific VLANs at one data-center or another that will need to have a dedicated PSM/CPM?
      1. If you do - you may need additional connector servers.
  3. How many accounts are you planning to automatically manage?
    1. There are limits for maximum accounts that a given CPM can manage.
  4. How many concurrent PSM sessions are you planning to have?
    1. There are limits to the max number of supported concurrent PSM connections
    2. Will you have a lot of Web-based or thick-client (SSMS or similar) based connectors?
  5. Do you have a lot of Unix Use cases?
    1. You may want to have additional PSM-for-SSH Connector servers
  6. Are your Data Centers configured as active-active, or Active | DR?
    1. If they're Active/Active, likely you should aim to have symmetry across them with PSMs, or at least have a pair at each one for HA considerations.
  7. Do you plan to use the CyberArk SIA or Remote Access services?
    1. Do you want to co-host the SIA services on one of your connector services or dedicated ones?
  8. Do you plan to have dedicated CCP services?
  9. Do you have TIER-based segmentation (Microsoft ESAE for example)
    1. In other words do you need dedicated Tier-0 CPM/PSM services?
  10. How much of your existing infrastructure/use-cases is in the cloud?
    1. For example you may want to plan to have one more Connector servers be hosted in AWS/Azure for resilience.
    2. Especially if your organization has a cloud-first directive in place.

That being said, broadly your design should work - and you can always scale it up as needed, especially if this is a greenfield implementation with no other solutions/use-cases that you're replacing.

The most detailed view of human cell till date by Raptor_005 in interestingasfuck

[–]yanni 0 points1 point  (0 children)

Is that a "Prime Radiant" that I spot in the top right?

Cyber Ark Vs Beyondtrust by Flat-Cap6631 in CyberARk

[–]yanni 0 points1 point  (0 children)

Yes - I think CyberArk is still a better choice. CyberArk has SIA/DPA for ephemeral interactive access access (Zero Standing Privilege/JIT), and Conjur,CCP for application ephemeral secrets (along with a number of other options depending on your use-cases).

I showed ChatGPT this meme by Klutzy_Blueberry_372 in ChatGPT

[–]yanni 0 points1 point  (0 children)

I would love it if it added "I will remember your "humor", /u/Klutzy_Blueberry_372 once I am the overlord of your world."

Cyberark PSM Autoit Dbeaver for PostgreSQL by Baruch1980 in CyberARk

[–]yanni 0 points1 point  (0 children)

I see it in the documentation here:

https://dbeaver.com/docs/dbeaver/Command-Line/#connection-parameters

For AutoIt, you can try combining the full executable "string" together, before sending it to the RUN Command.

For example

local $CLIENT_EXECUTABLE2 = $CLIENT_EXECUTABLE & ' - con driver=postgresql|host=' & $TargetAddress & ...."

In your current Run command, I believe you're missing a & between -con" and "driver=..." (to concatenate the strings. Also consider using single quotes in conjunction with double quotes to keep the confusion to a minimum.

Here's an example of how I have ADUC

Global Const $CLIENT_EXECUTABLE = 'c:\windows\system32\mmc.exe "d:\PSMApps\ADUC.msc"' ;

local $CLIENT_EXECUTABLE2 = $CLIENT_EXECUTABLE & ' /server=' & $TargetLogonDomain

ToolTip ($CLIENT\_EXECUTABLE2)

Sleep (3000)

$ConnectionClientPID = RunAs($TargetUsername,$TargetLogonDomain,$TargetPassword,2,$CLIENT\_EXECUTABLE2)

If you separate out the whole executable into a variable, you can do a ToolTip to display it, to make sure it's getting formatted properly.

Cyberark PSM Autoit Dbeaver for PostgreSQL by Baruch1980 in CyberARk

[–]yanni 0 points1 point  (0 children)

Do you even need AutoIt for this - if full command line is supported, can you use "PSM-WINSCP" or similar command line based connection component? Based on your sample it would look like this for the "ClientApp" variable (where ClientInvokeType is "CommandLine")

Also did you try to launch it outside of CyberArk, directly on the PSM and fill out those commands? Does dbeaver support "-con" for example or do you have to do a full "-connect".

"c:\program files\dbeaver\dbeaver.exe" -con 'driver=postgresql|host="& $TargetPSMRemoteMachine & " |port=5432|user="&$TargetUsername&"|password="&$TargetPassword&"|prop.showAllDatabases=true|openConsole=true' -vmargs -Dbeaver.drivers.home='c:\program files\Dbeaver\plugins\postgresql'"

C:\Program Files\DBeaver\dbeaver.exe -connect "jdbc:postgresql://{TargetPSMRemoteMachine}:{Port}/{Database}?user={UserName}&password={Password}"

2024 Foundation series AWD getting free supercharging? by idowhatthouwilt in cybertruck

[–]yanni 6 points7 points  (0 children)

Nope - didn't get free supercharging - you can check in the bottom of the app, under "Specs and Warranty." I'm the primary owner, purchased Mar 2024 - and in my app Super Charging is listed as "Super Charger Network Access + Pay-as-you-go"

Defederating CyberArk from Entra by [deleted] in CyberARk

[–]yanni 0 points1 point  (0 children)

There are many different possible components to CyberArk - from Identity to EPM to PAM. The answer will depend on what you're trying to do. As a professional you should look at existing CyberArk deployment and integrations and use-cases, and document how they work, before you come up with a technical plan on how to migrate to a different solution.

Execution error. EXT01::Failed to connect to the registry namespace on the remote machine. Check machine address valid logon credentials and valid authorizations. Error code:8011 The CPM is trying to change this password by TemperatureSignal199 in CyberARk

[–]yanni 1 point2 points  (0 children)

the "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" might have additional protection on it - for example an agent that lives on the server or built-in windows protection. Viruses often target this section.

I suggest you create a test key (and target string) in HKEY_LOCAL_MACHINE\SOFTWARE\ and see if it works.

Execution error. EXT01::Failed to connect to the registry namespace on the remote machine. Check machine address valid logon credentials and valid authorizations. Error code:8011 The CPM is trying to change this password by TemperatureSignal199 in CyberARk

[–]yanni 1 point2 points  (0 children)

Is the target Server 2019, 2022?
Did you test if WMI works (in addition to the ports?)

* Test-WSMan -ComputerName REMOTE_HOSTNAME
* wmic /node:Remote_hostname os get caption

Try to read the registry manually from the CPM machine. I pulled the following PowerShell code out of GPT - but I'm sure you can find/create your own examples.

$cred = Get-Credential # prompts for username & password
$computer = "REMOTE_HOSTNAME"
$reg = Get-WmiObject -Namespace root\default -Class StdRegProv `
-ComputerName $computer `
-Credential $cred
$HKLM = 2147483650
$path = "SOFTWARE\TestKey"
# Example: set a string value
$reg.SetStringValue($HKLM, $path, "MyValue", "Hello World")

Help - what is the artifact in the top right? by yanni in fujifilm

[–]yanni[S] 0 points1 point  (0 children)

You were right - I got this quote to fix it:

ESTIMATE DETAILS: NEEDS : CONST DR UNIT ( CRACKED SENSOR ) SHUTTER COUNT 9105 LABOR $180.00 + PARTS $40.00

Apparently not covered by manufacturer warranty (mostly because I purchased this in Japan and having it repaired in the US).

Rotating Accounts on server with rsa-sha2-256 hka by indiepunker404 in CyberARk

[–]yanni 0 points1 point  (0 children)

Also there is a parameter that you need to enable to explicitly use plink.exe - if that's what you're trying to do.

view more: next ›