CyberArk Operations & Account Onboarding

Your CyberArk environment is deployed and configured. Now it is time to use it. This guide covers the day-to-day operational tasks every CyberArk professional must know — onboarding accounts, managing passwords, monitoring sessions, handling emergencies, and generating audit evidence.

What You Will Learn

1. Onboard a Windows local admin account into the vault
2. Test CPM password rotation
3. Configure and test PSM session proxying
4. Retrieve credentials via AIM (Application Identity Manager)
5. Use PACLI for command-line vault operations
6. Generate audit reports and evidence
7. Handle common operational scenarios
8. Configure break-glass emergency procedures

Onboarding a Privileged Account

Onboarding — also called platform onboarding — is the process of adding a privileged account to the CyberArk vault so that CPM can manage its password. This is the single most common operational task in CyberArk administration.

Understanding Platforms

Before onboarding, you must understand Platforms. A platform is a template that defines how CyberArk connects to and manages a specific type of target system. Each platform includes:

• Connection parameters — protocol, port, authentication method
• Password management commands — how CPM changes the password on that system type
• Verification commands — how CPM verifies the current password
• Reconciliation commands — how CPM fixes a password mismatch

CyberArk ships with dozens of pre-configured platforms. For your lab, the relevant ones are:

# On PVWA01 (where CPM runs), test connectivity to TARGET01
Test-NetConnection 192.168.100.40 -Port 445  # SMB
Test-NetConnection 192.168.100.40 -Port 5985 # WinRM HTTP
Test-NetConnection 192.168.100.40 -Port 5986 # WinRM HTTPS

# On TARGET01, as Administrator
Enable-PSRemoting -Force
Set-Item WSMan:\localhost\Client\TrustedHosts -Value "PVWA01" -Force
Restart-Service WinRM

Account Name              │ Safe                  │ Platform            │ Status      │ Last Verified
──────────────────────────┼───────────────────────┼─────────────────────┼─────────────┼──────────────
TARGET01\Administrator    │ LAB-Win-LocalAdmins   │ Win Server Local    │ ✓ Verified  │ Just now

Onboarding a Linux Root Account

To onboard a Linux target, repeat the process with:

Testing CPM Password Rotation

Once an account is onboarded, CPM will manage its password according to the assigned policy. You can trigger an immediate rotation to test the configuration.

Trigger Manual Rotation

1. CPM reads current password from vault    ──→  ✓ Done
2. CPM connects to TARGET01 via WinRM       ──→  ✓ Connected
3. CPM verifies current password             ──→  ✓ Matches
4. CPM generates new password per policy     ──→  ✓ Generated (28 chars)
5. CPM changes password on TARGET01          ──→  ✓ Changed
6. CPM verifies new password on TARGET01     ──→  ✓ Works
7. CPM updates password in vault             ──→  ✓ Stored
8. CPM logs successful rotation              ──→  ✓ Logged

# On PVWA01, check the CPM log for the rotation event
Get-Content "C:\CyberArk\CPM\Logs\CPM.log" -Tail 100 | Select-String -Pattern "TARGET01"

What Happens During Automatic Rotation

    sequenceDiagram
    participant Vault as CyberArk Vault
    participant CPM as CPM Service
    participant Target as TARGET01

    Note over CPM: Rotation timer fires (e.g., every 30 days)
    CPM->>Vault: Request account: TARGET01\Administrator
    Vault->>CPM: Return current password
    
    CPM->>Target: Connect via WinRM
    CPM->>Target: Verify current password
    Target->>CPM: Authentication success
    
    CPM->>CPM: Generate new password (25 chars, all types)
    
    CPM->>Target: Change password to new value
    Target->>CPM: Password changed successfully
    
    CPM->>Target: Verify new password
    Target->>CPM: New password works
    
    CPM->>Vault: Store new password
    Vault->>CPM: Stored, old password retained (version history)
    
    CPM->>CPM: Log success
  

Configuring and Testing PSM Sessions

PSM provides proxied, recorded access to target systems. Instead of connecting directly to TARGET01, users connect through PSM, which injects the credential automatically and records the entire session.

Configure PSM for Windows Connections

PSM SSH Connections

For Linux targets, CyberArk uses PSMP (Privileged Session Manager for SSH):

# From a Linux client that can reach the PSM server
# Install the SSH client if needed
ssh pamadmin@192.168.100.30 -p 2222

# When prompted, select the target:
# Target Address: 192.168.100.50
# Account: root

# PSMP will authenticate to the vault, retrieve the credential,
# and proxy the SSH session with full recording

Using AIM for Application Credentials

AIM (Application Identity Manager) provides programmatic credential retrieval for applications and automation. This is how scripts, CI/CD pipelines, and scheduled tasks get credentials without hardcoding them.

Configure AIM

# On PVWA01, check that the AIM web service is running
Get-Service "CyberArk AIM"
# If not running:
Start-Service "CyberArk AIM"

# Verify the AIM endpoint
Invoke-WebRequest -Uri "http://localhost:8081/AIMWebService/api/Accounts" -UseBasicParsing

# On PVWA01 (or any machine in 192.168.100.0/24), test AIM

# Using PowerShell
$response = Invoke-RestMethod -Uri `
  "http://localhost:8081/AIMWebService/api/Accounts?AppID=MyLabApp&Safe=LAB-Service-Accounts&Object=TARGET01%5CAdministrator"

Write-Output "Username: $($response.UserName)"
Write-Output "Password: $($response.Content)"

# Using curl
curl "http://localhost:8081/AIMWebService/api/Accounts?AppID=MyLabApp&Safe=LAB-Service-Accounts&Object=TARGET01%5CAdministrator"

{
  "Content": "G7$k2mN9#pQ4$xR8*vW1!zB6",
  "UserName": "TARGET01\\Administrator",
  "Address": "192.168.100.40",
  "Safe": "LAB-Service-Accounts",
  "Folder": "Root",
  "Object": "TARGET01\\Administrator",
  "PolicyID": "LAB-Standard-Rotation-30",
  "PasswordChangeInProcess": "False",
  "LastModified": "2026-06-15T10:30:00Z"
}

Using PACLI — Command-Line Vault Operations

PACLI (Privileged Access Command Line Interface) is a command-line tool for vault operations. It is essential for automation and scripting.

Basic PACLI Commands

# Navigate to PACLI directory (installed with PVWA)
cd "C:\CyberArk\Vault"

# Initialize PACLI environment
.\PACLI.exe INIT

# Define vault definition
.\PACLI.exe DEFINEDVAULT -vault VAULT01 -ip 192.168.100.20 -port 1858

# Log into vault
.\PACLI.exe LOGON -vault VAULT01 -user Administrator -password V@ultAdmin!2026

# List all safes
.\PACLI.exe SAFESLIST -vault VAULT01

# List accounts in a safe
.\PACLI.exe ACCOUNTSLIST -vault VAULT01 -safe "LAB-Win-LocalAdmins"

# Get account details
.\PACLI.exe ACCOUNTDETAILS -vault VAULT01 -safe "LAB-Win-LocalAdmins" `
  -account "TARGET01\Administrator"

# Retrieve a password (requires reason)
.\PACLI.exe ACCOUNTPASSWORDGET -vault VAULT01 -safe "LAB-Win-LocalAdmins" `
  -account "TARGET01\Administrator" -reason "Operational test"

# Log off
.\PACLI.exe LOGOFF -vault VAULT01

# Terminate PACLI
.\PACLI.exe TERM

PACLI for Automation

PACLI is frequently used in scripts for automated operations:

# Automated password retrieval script
$vault = "VAULT01"
$user = "pamadmin"
$password = "P@mAdmin!2026"
$safe = "LAB-Service-Accounts"
$account = "SQLSvc_Prod"
$reason = "Scheduled backup job"

cd "C:\CyberArk\Vault"
.\PACLI.exe INIT
.\PACLI.exe DEFINEDVAULT -vault $vault -ip 192.168.100.20 -port 1858
.\PACLI.exe LOGON -vault $vault -user $user -password $password
$result = .\PACLI.exe ACCOUNTPASSWORDGET -vault $vault -safe $safe `
  -account $account -reason $reason
.\PACLI.exe LOGOFF -vault $vault
.\PACLI.exe TERM

Write-Output $result

Generating Audit Reports

Audit evidence is a primary output of any PAM system. CyberArk provides built-in reports for compliance.

Built-in Reports

In PVWA, go to ☰ Menu → Reports to access:

Generate an Activity Report

1. Go to ☰ Menu → Reports → Privileged Account Activity
2. Set date range (e.g., last 7 days)
3. Select safe (or leave blank for all)
4. Click Generate
5. Export as PDF or CSV for audit evidence

View Audit Log

The Audit section shows every action in the vault:

1. Go to ☰ Menu → Audit
2. Filter by:
   • Date Range: Last 24 hours
   • Action: Password retrieval
   • User: pamadmin
3. You should see all your test retrievals logged with timestamps and reasons

Emergency Break-Glass Procedures

Despite all automation, there will be scenarios where normal CyberArk access is unavailable. Break-glass procedures ensure you can still access critical systems during emergencies.

Break-Glass Scenarios

Configuring a Break-Glass Safe

Break-glass accounts are stored in a safe with no automatic password management (manual rotation only). This ensures the password does not change without explicit human action.

1. Go to ☰ Menu → Safes → LAB-BreakGlass
2. Verify these settings:
   • Allow automatic password management: ❌ Disabled
   • Password rotation: Manual only
   • Members: Vault Admin only (plus maybe 1 emergency contact)
   • Dual control: ❌ Disabled (speed over control in emergencies)

Onboarding Break-Glass Accounts

# Onboard the vault's own Administrator account as a break-glass entry
# This is critical — if you lose the vault admin password, you lose everything

In the LAB-BreakGlass safe, add:

Store the break-glass credentials in a sealed envelope or encrypted password manager outside of CyberArk.

Break-Glass Procedure

    flowchart TD
    A[Incident detected<br/>requiring privileged<br/>access] --> B[Declare emergency<br/>via ITSM ticket]
    B --> C{Is vault<br/>available?}
    C -->|Yes| D[Request access via<br/>break-glass safe<br/>with post-event approval]
    C -->|No| E[Retrieve credentials<br/>from offline<br/>emergency storage]
    D --> F{Approved?}
    F -->|Yes| G[Access target system<br/> Log everything]
    F -->|No| H[Escalate to<br/>PAM manager]
    E --> G
    G --> I[Complete task]
    I --> J[Rotate ALL <br/>used credentials<br/>immediately]
    J --> K[Document incident<br/> Post-incident review]
  

Common Operational Tasks Reference

How to: Find an Account

# In PVWA: ☰ Menu → Accounts → Search box
# Search by: Account name, username, address, safe, or platform

# Using PACLI:
PACLI.exe ACCOUNTSLIST -vault VAULT01 -safe "LAB-Win-LocalAdmins"

How to: Retrieve a Password

# In PVWA: Accounts → Select account → "Copy Password" or "Show Password"
# Both actions require a reason and are logged in the audit trail

# Using PACLI:
PACLI.exe ACCOUNTPASSWORDGET -vault VAULT01 -safe "LAB-Win-LocalAdmins" -account "TARGET01\Administrator" -reason "Routine maintenance"

How to: Add a New Safe Member

# In PVWA: Safes → Select safe → Members → Add Member
# Select user/group → Grant specific permissions → OK

How to: Modify a CPM Policy

# In PVWA: Policies → Select policy → Edit
# Change rotation frequency, complexity, or assigned safes → Save
# Changes apply at the next scheduled rotation

How to: Manually Trigger Password Verification

# In PVWA: Accounts → Select account → Verify Password
# CPM will immediately check the password against the target

How to: View Session Recording

# In PVWA: Accounts → Select account → Session Recordings tab
# Select a session → Play
# Use the player controls: pause, skip, speed control

How to: Disable an Account (without deleting)

# In PVWA: Accounts → Select account → Disable
# The account remains in the vault but CPM stops managing it
# No one can check out the password while disabled

How to: Delete an Account

# In PVWA: Accounts → Select account → Delete
# WARNING: This permanently removes the account from the vault
# Only delete when the account no longer exists on the target

Troubleshooting Common Operational Issues

CPM Password Change Fails

PSM Connection Fails

AIM Issues

Operations Checklist

Use this checklist to confirm operational readiness:

Key Takeaways

• Account onboarding is the most frequent operational task — select the correct platform, safe, and CPM policy for each account type
• CPM automates the entire password lifecycle — verification, rotation, reconciliation — but must be tested after each configuration change
• PSM provides zero-knowledge access — users connect through the proxy without ever seeing the password, and every keystroke is recorded
• AIM enables secure automation — applications and scripts retrieve credentials programmatically without hardcoding secrets
• PACLI is essential for automation and recovery — when PVWA is unavailable, PACLI is the command-line backup access method
• Break-glass procedures must be documented and tested — emergencies will happen, and the plan must be proven before it is needed
• Audit logs are the compliance deliverable — every action in CyberArk generates an audit record; ensure they are centralised in your SIEM