CyberArk Lab Deployment — Step-by-Step Guide

# Run PowerShell as Administrator

# Set static IP
New-NetIPAddress -InterfaceAlias "Ethernet0" `
  -IPAddress 192.168.100.10 `
  -PrefixLength 24 `
  -DefaultGateway 192.168.100.1

# Set DNS to self (will be the DC)
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" -ServerAddresses 127.0.0.1

# Rename computer
Rename-Computer -NewName "DC01" -Restart

# Install AD DS role
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Promote to Domain Controller (create new forest)
# Use a .local or .lab domain — do NOT use a public domain name
Install-ADDSForest `
  -DomainName "cyberark.lab" `
  -DomainNetbiosName "CYBERARK" `
  -ForestMode "WinThreshold" `
  -DomainMode "WinThreshold" `
  -InstallDns:$true `
  -SafeModeAdministratorPassword (ConvertTo-SecureString "L@bAdmin!2026" -AsPlainText -Force) `
  -Force:$true

# Check domain and forest info
Get-ADDomain | Format-List Name, DNSRoot, DomainMode
Get-ADForest | Format-List Name, ForestMode, RootDomain

# Create organizational units for CyberArk
New-ADOrganizationalUnit -Name "CyberArk" -Path "DC=cyberark,DC=lab"
New-ADOrganizationalUnit -Name "ServiceAccounts" -Path "OU=CyberArk,DC=cyberark,DC=lab"
New-ADOrganizationalUnit -Name "CyberArkAdmins" -Path "OU=CyberArk,DC=cyberark,DC=lab"
New-ADOrganizationalUnit -Name "TargetServers" -Path "DC=cyberark,DC=lab"

# Create service accounts for CyberArk components
New-ADUser -Name "svc-vault" -SamAccountName "svc-vault" `
  -UserPrincipalName "svc-vault@cyberark.lab" `
  -Path "OU=ServiceAccounts,OU=CyberArk,DC=cyberark,DC=lab" `
  -AccountPassword (ConvertTo-SecureString "Svc@ccount!2026" -AsPlainText -Force) `
  -Enabled:$true -PasswordNeverExpires:$true

New-ADUser -Name "svc-pvwa" -SamAccountName "svc-pvwa" `
  -UserPrincipalName "svc-pvwa@cyberark.lab" `
  -Path "OU=ServiceAccounts,OU=CyberArk,DC=cyberark,DC=lab" `
  -AccountPassword (ConvertTo-SecureString "Svc@ccount!2026" -AsPlainText -Force) `
  -Enabled:$true -PasswordNeverExpires:$true

New-ADUser -Name "svc-cpm" -SamAccountName "svc-cpm" `
  -UserPrincipalName "svc-cpm@cyberark.lab" `
  -Path "OU=ServiceAccounts,OU=CyberArk,DC=cyberark,DC=lab" `
  -AccountPassword (ConvertTo-SecureString "Svc@ccount!2026" -AsPlainText -Force) `
  -Enabled:$true -PasswordNeverExpires:$true

# Create administrative users
New-ADUser -Name "PAM Admin" -SamAccountName "pamadmin" `
  -UserPrincipalName "pamadmin@cyberark.lab" `
  -Path "OU=CyberArkAdmins,OU=CyberArk,DC=cyberark,DC=lab" `
  -AccountPassword (ConvertTo-SecureString "P@mAdmin!2026" -AsPlainText -Force) `
  -Enabled:$true -PasswordNeverExpires:$true

New-ADUser -Name "PAM Auditor" -SamAccountName "pamauditor" `
  -UserPrincipalName "pamauditor@cyberark.lab" `
  -Path "OU=CyberArkAdmins,OU=CyberArk,DC=cyberark,DC=lab" `
  -AccountPassword (ConvertTo-SecureString "P@mAudit!2026" -AsPlainText -Force) `
  -Enabled:$true -PasswordNeverExpires:$true

# Add pamadmin to Domain Admins (required for initial setup)
Add-ADGroupMember -Identity "Domain Admins" -Members "pamadmin"

# Verify
Get-ADUser -Filter * -SearchBase "OU=CyberArk,DC=cyberark,DC=lab" | Format-Table Name, SamAccountName

# Update the system
dnf update -y

# Install required packages
dnf install -y net-tools bind-utils vim wget curl tar gzip unzip \
  lvm2 device-mapper-persistent-data nfs-utils

# Disable unnecessary services
systemctl stop firewalld
systemctl disable firewalld
systemctl stop postfix
systemctl disable postfix

# Disable SELinux (required by CyberArk Vault)
# Edit /etc/selinux/config
sed -i 's/^SELINUX=.*/SELINUX=disabled/' /etc/selinux/config

# Set kernel parameters for CyberArk Vault
cat >> /etc/sysctl.d/99-cyberark.conf << 'EOF'
kernel.shmmax = 4294967295
kernel.shmall = 1073741823
kernel.sem = 1000 1024000 500 1024
fs.file-max = 6553600
net.core.somaxconn = 4096
net.ipv4.ip_local_port_range = 11000 65535
vm.max_map_count = 262144
EOF

# Apply kernel parameters
sysctl -p /etc/sysctl.d/99-cyberark.conf

# Increase file descriptor limits
cat >> /etc/security/limits.d/99-cyberark.conf << 'EOF'
* soft nofile 6553600
* hard nofile 6553600
* soft nproc 6553600
* hard nproc 6553600
EOF

# Set system-wide ulimit
echo "ulimit -n 6553600" >> /etc/profile

# Reboot to apply SELinux change
reboot

# After reboot, verify connectivity to DC01
ping 192.168.100.10

# Verify DNS resolution
nslookup dc01.cyberark.lab 192.168.100.10

# If DNS does not resolve, check /etc/resolv.conf
cat /etc/resolv.conf
# Should contain: nameserver 192.168.100.10

# Install SSSD for domain integration
dnf install -y sssd realmd oddjob oddjob-mkhomedir adcli samba-common

# Discover the domain
realm discover cyberark.lab

# Join the domain
echo "Svc@ccount!2026" | realm join --user=svc-vault cyberark.lab

# Verify domain join
realm list
# Should show: domain-name: cyberark.lab
#              configured: kerberos-member

# Configure SSH to allow domain users
echo "AllowUsers root pamadmin@cyberark.lab" >> /etc/ssh/sshd_config
systemctl restart sshd

# Create the vault installation directory structure
mkdir -p /opt/CyberArk/Vault
mkdir -p /opt/CyberArk/Vault/Backup
mkdir -p /var/log/cyberark/vault
mkdir -p /var/cyberark/vault/db
mkdir -p /var/cyberark/vault/conf

# Create the vault user
useradd -m -s /bin/bash -d /home/vault vault
echo "V@ultUser!2026" | passwd --stdin vault

# Set ownership
chown -R vault:vault /opt/CyberArk
chown -R vault:vault /var/log/cyberark
chown -R vault:vault /var/cyberark

# Check vault service status
systemctl status vaultd

# Should show: Active: active (running)

# Check vault process
ps aux | grep vault
# Should show the Vault server process running

# Check vault log for any errors
tail -50 /var/log/cyberark/vault/vault.log

# Check vault port listening
netstat -tlnp | grep 1858
# Should show: LISTEN on port 1858 (CyberArk Vault default port)

New-NetIPAddress -InterfaceAlias "Ethernet0" `
  -IPAddress 192.168.100.30 `
  -PrefixLength 24 `
  -DefaultGateway 192.168.100.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" -ServerAddresses 192.168.100.10

Rename-Computer -NewName "PVWA01"
# After reboot, join domain
Add-Computer -DomainName "cyberark.lab" -Credential CYBERARK\Administrator -Restart

# Install IIS with required features
Install-WindowsFeature -Name Web-Server, Web-WebServer, `
  Web-Common-Http, Web-Default-Doc, Web-Dir-Browsing, `
  Web-Http-Errors, Web-Static-Content, Web-Http-Redirect, `
  Web-Health, Web-Http-Logging, Web-Custom-Logging, `
  Web-Log-Libraries, Web-Request-Monitor, Web-Http-Tracing, `
  Web-Performance, Web-Stat-Compression, Web-Dyn-Compression, `
  Web-Security, Web-Filtering, Web-Basic-Auth, `
  Web-Windows-Auth, Web-Digest-Auth, Web-Client-Auth, `
  Web-Cert-Auth, Web-IP-Security, Web-URL-Auth, `
  Web-App-Dev, Web-Net-Ext45, Web-Asp-Net45, `
  Web-ISAPI-Ext, Web-ISAPI-Filter, `
  Web-Mgmt-Tools, Web-Mgmt-Console, Web-Mgmt-Compat, `
  Web-Metabase, Web-WMI, Web-Scripting-Tools, `
  Web-Lgcy-Scripting -IncludeAllSubFeature -IncludeManagementTools

# Install .NET Framework 4.8+ features
Install-WindowsFeature -Name NET-Framework-45-Core, NET-Framework-45-Features, `
  NET-WCF-HTTP-Activation45 -IncludeAllSubFeature

# Install WebDAV and other IIS extras
Install-WindowsFeature -Name Web-DAV-Publishing, Web-DAV-Redirector

# Restart
Restart-Computer

# Download SQL Server Express (or use the one bundled with CyberArk installer)
# The CyberArk PVWA installer includes SQL Server Express, or you can pre-install it

# If installing separately:
# 1. Download SQL2022-SSEI-Expr.exe from Microsoft
# 2. Run: SQL2022-SSEI-Expr.exe /MediaType=Local /Action=Download
# 3. Execute: SETUP.exe

# For automated install from the CyberArk bundle:
# Locate SQLServerExpressInstaller.exe in the CyberArk installation media
# Run with default settings - the PVWA installer will configure it

# Check IIS site
Get-Website | Where-Object { $_.Name -eq "CyberArk" } | Format-List

# Test HTTPS connectivity
Invoke-WebRequest -Uri "https://localhost" -UseBasicParsing

# Check PVWA logs
Get-ChildItem "C:\CyberArk\PVWA\Logs\" | Sort-Object LastWriteTime -Descending | Select-Object -First 5

# Extract CPM installation package
Expand-Archive -Path "C:\Install\CyberArk_PAS_14.2_CPM.zip" `
  -DestinationPath "C:\Install\CPM"

# Verify prerequisites
# CPM requires:
# - .NET Framework 4.8+
# - The target application servers must be reachable (we will configure later)
# - CPM service account must have local admin on target systems

# Run the CPM installer
cd "C:\Install\CPM"
.\CyberArk_CPM_Install.exe

# Installer wizard steps:
# 1. Welcome — Next
# 2. License — Accept
# 3. Vault Connection:
#    - Vault IP: 192.168.100.20
#    - Vault Port: 1858
# 4. CPM Service Account:
#    - User: CYBERARK\svc-cpm
#    - Password: Svc@ccount!2026
# 5. Installation Path — Default (C:\CyberArk\CPM)
# 6. Begin Installation

# After installation, verify CPM service
Get-Service -Name "CyberArk CPM" | Format-List Status, Name, DisplayName

# Extract PSM installation package
Expand-Archive -Path "C:\Install\CyberArk_PAS_14.2_PSM.zip" `
  -DestinationPath "C:\Install\PSM"

# Run the PSM installer
cd "C:\Install\PSM"
.\CyberArk_PSM_Install.exe

# Installer wizard steps:
# 1. Welcome — Next
# 2. License — Accept
# 3. Vault Connection:
#    - Vault IP: 192.168.100.20
#    - Vault Port: 1858
# 4. PSM Service Account:
#    - User: CYBERARK\svc-pvwa (reuse the PVWA service account)
#    - Password: Svc@ccount!2026
# 5. Installation Path — Default (C:\CyberArk\PSM)
# 6. PSM Shadow Users — Create local shadow users (accept defaults)
# 7. Begin Installation

# After installation, verify PSM service
Get-Service -Name "CyberArk PSM" | Format-List Status, Name, DisplayName

# On TARGET01, as Administrator:

# Set static IP
New-NetIPAddress -InterfaceAlias "Ethernet0" `
  -IPAddress 192.168.100.40 `
  -PrefixLength 24 `
  -DefaultGateway 192.168.100.1
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" -ServerAddresses 192.168.100.10

# Rename and join domain
Rename-Computer -NewName "TARGET01"
# Restart, then:
Add-Computer -DomainName "cyberark.lab" -Credential CYBERARK\Administrator -Restart

# On TARGET01, create a local admin account that we will vault in CyberArk
$localAdminPassword = ConvertTo-SecureString "T@rgetL0cal!2026" -AsPlainText -Force
New-LocalUser -Name "targetadmin" -Password $localAdminPassword -PasswordNeverExpires
Add-LocalGroupMember -Group "Administrators" -Member "targetadmin"

# From PVWA01, verify vault connectivity using CyberArk's vault utility
# Located at: C:\CyberArk\Vault\ (installed as part of PVWA)

cd "C:\CyberArk\Vault"
.\CreateCredFile.exe AppProvider "C:\temp\vault.cred" /Password V@ultAdmin!2026 /UserName Administrator /Ent