For changing these resource passwords, Privileged Access Manager uses tasks. Tasks contains the script that must be executed for password change and the scheduling option required to execute the script. The tasks are associated to a vault. For more information about vaults, see Contextual Help. By default, every vault will have a password change task associated with it. This task is executed for the credentials in the vault, which has the Change Password Policy option enabled.
In addition, if you want to perform any automated task after a password change, it can be added as a service task. For example, if you want to perform backup after changing the account password, it can be defined as a service task. These service tasks are custom tasks for creating a custom script and adding it to the task. For more information about the template for creating a custom script, contact Customer Support.
For Windows and Active Directory:
Privileged Access Manager provides out-of-the-box scripts to the change password of Windows local machine and Active Directory.
In addition to windows account password change, Privileged Access Manager also offers the capability to change the password of service accounts. Privileged Access Manager provides out-of-the-box scripts to change the password of service accounts, such as such as Windows Services, COM+, Task Scheduler, and IIS Pool. You can define a custom script for password change for other service accounts and associate it to a service task.
These service account tasks are executed only for those credential with the appropriate service account associated with it. This association can be defined when adding a credential. When you are adding a credential for an active directory, Privileged Access Manager provides a capability for you to define the machines where the credential is used for service accounts. This will help in end to end password change of the Active Directory accounts.
For Linux and Network Devices:
Privileged Access Manager provides out-of-the-box script to change password of Linux and Network devices that can be connected using SSH protocol. Privileged Access Manager can rotate both the password or the SSH key that is configured for a credential.
If you want to change the password of associated service accounts, you can define a custom script for service account password change and associate it to a service task.
For more information about configuring tasks and scripts, see Contextual Help.
|
Resource |
Password Management |
Schedule Password Change |
Change Password in Associated Services |
Custom Task Execution after Password change |
|---|---|---|---|---|
|
Windows |
Yes |
Yes |
Yes |
Yes |
|
UNIX, Linux and Network Device |
||||
|
Linux and Network Devices using SSH connection |
Yes |
Yes |
No |
Yes |
|
Telnet (Linux and Network Devices using Telnet connection) |
No |
No |
No |
No |
|
UNIX |
No |
No |
No |
No |
|
LDAP |
||||
|
Windows Active Directory |
Yes |
Yes |
Yes |
Yes |
|
NetIQ eDirectory |
No |
No |
No |
No |
|
OpenLDAP |
No |
No |
No |
No |
|
Database |
Yes |
No You can only enable the password to be changed immediately after credential check-in. |
No |
No |
|
Application |
||||
|
Application Credential Checkout |
Yes |
No You can only enable the password to be changed immediately after credential check-in. |
No |
No |
|
Application SSO |
No |
No |
No |
No |
|
Key |
No These are static keys that cannot be rotated. |
No |
No |
No |