7.3.3 Prerequisites

  • Ensure that the Task Manager module is installed.

    • The task manager component of Privileged Account Manager (taskmanager) is supported only on Windows, SLES 12 (64-bit), SLES 15 (64-bit), RHEL 7.5 (64-bit), or RHEL 8(64-bit).

      NOTE:

      • For RHEL 8 (64-bit) and RHEL 7 (64 bit), install the redhat-lsb-core package.

      • For SLES 12 (64-bit) and SLES 15 (64-bit), install the lsb-release package.

    • If you want to configure task manager on a separate agent, you must first install Privileged Credential Manager package (prvcrdvlt) and Access Manager package (auth), and then install Task Manager (taskmanager) module in the agent.

    • If you have multiple host domains in Privileged Account Manager, you must have Task Manager module installed on every host domain.

      For more information about installing a package in Privileged Account Manager, see Installing Packages on a Host.

    • If you have configured a Windows machine as task manager, ensure the following:

      • Powershell 4.0 or later must be installed in the Windows machine where you are installing the Task Manager module.

      • Windows Remote Management (WinRM) service must be running on the Windows machine. To start winrm service, use the command:

        Enable-PSRemoting –force

      • Add target machine, where the password must be changed, to the WinRM trusted host. To add all servers as trusted host, use the command:

        winrm set winrm/config/client '@{TrustedHosts="*"}'

      • Set the PowerShell execution policy to Remotesigned using the command:

        Set-ExecutionPolicy -ExecutionPolicy RemoteSigned

  • Ensure the following is done on the target machine where the password must be changed.

    • In Windows machine:

      • Powershell 2.0 or later must be installed in all the windows target machines as Privileged Account Manager uses PowerShell scripts to change password.

      • Windows Remote Management (WinRM) service must be running on the Windows machine. To start WinRM service, use the command:

        Enable-PSRemoting –force

      • IP address of the task manager must be added to the trusted host of the target machine. To add trusted host, use the command:

        winrm set winrm/config/client '@{TrustedHosts="x.x.x.x"}'

    • In AIX machine, configure the following:

      • Specify AcceptEnv LC_ALL in the sshd_config file.

      • Restart sshd service.

Configuring Password Management

To configure Privileged Account Manager to change (rotate) password of any resource, you must set the Password Change option value in the resource configuration to Yes and ensure that all the password change tasks are enabled. If the password change option is set to yes in a resource, this configuration will be inherited by all credentials in that resource. However, you can override them in the credential configuration. To modify the password management option of a resource, click Credential VaultVault Type Vault Nameedit icon next to the required resource.

Configuring Password Management in an Upgraded Setup

After upgrading Privileged Account Manager, if you want to enable password management, perform the following:

 

Tasks

Go To

  1. Review the prerequisites and ensure all the required configurations are complete.

Prerequisites

  1. Review all password change and service tasks associated with the vault and update when the task must be scheduled for execution.

Credential Vault > Vault Type > Vault Name > Associated Task > click edit icon next to the task

  1. (Conditional) By default, the out-of-the-box password policy provided by Privileged Account Manager is associated with every vault. You can choose to use the default policy or create a new policy and associate with the vault.

Credential Vault > Password Policies > Help icon

  1. Perform the following on all the resources:

    1. Edit the resource and set the Password Change option as Yes. Also, review and modify all password management options, such as reconcile account and so on.

      These password management values will be inherited by all credentials in the resource.

    2. (Conditional) If you do not want Privileged Account Manager to change reconcile account password, set Password Change option as No in the appropriate resource credential.

      We recommended you to set Password Change to No for reconcile account. Also, you must have one local administration account, which is not managed by Privileged Account Manager to resolve any password change issue.

    3. (Conditional) For Windows, if the credential is used as a service account, you must edit the credential and modify the service association.

    4. (Conditional) For Active Directory, if the credential is used as a service account in any of the Windows machine, you must add the Windows machine to the credential and update the service association.

Credential Vault > Vault Type > Vault Name > click edit icon of the required resource

Credential Vault > Vault Type > Vault Name > Resource Name > click edit icon of the required credential

Disabling Password Management

You can disable password management at task level or resource level.

  • At resource level, you can disable password rotation (change) of all credentials or a specific credential in a resource.

    To disable password management of all accounts in a resource, edit the resource configuration and set the Password Change to No. Similarly, to disable password management for a credential, edit the credential configuration and set the Password Change to No.

  • At task level, you can disable the password change task of any vault to stop execution of the task.

    Before you disable any task, review and resolve all the errors related to the task in the failed reports page. As the reports relates to failed reports are not displayed when the task is disabled.