Troubleshooting Common Issues

By the end of this session, you will be able

to perform basic troubleshooting tasks to
resolve common issues related to:

• User authentication

Agenda • Component connectivity to the Vault

• Automatic password management by CPM

• Launching privileged sessions via PSM

2

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

 User Authentication Issues

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

User Receives an Authentication Failure
Bill is unable to log in.
He changed his network password
recently and tried to log in to the
PVWA with his old password.
Now he is trying with his new
password and it does not work.
He contacts his Vault administrator.
 The Vault administrator can see in
the ITAlog on the Vault that the user
Bill failed to log in 5 times and then
was suspended.

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 6

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 The Vault can be configured to unsuspend users automatically after a predefined time period,
using the UserLockoutPeriodInMinutes parameter in dbparm.ini.

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 Component Connectivity
Issues

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

 In the PVWA System Health,
we can see that the CPM user
is disconnected

With Component Monitoring

enabled, if the CPM fails to
connect to the Vault, the Vault
Admin will receive an email
notification

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 • Occasionally, the passwords for a
component user can get out of sync: the
password stored in the Vault no longer
matches the password stored in the
credential file.
• There is a tool available in the CyberArk
Support Vault that can be used to
unsuspend component users
(Solution 3643).
• These next few slides will show you how to
do it manually for the default CPM
component user PasswordManager.
10

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
1

11

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
2

Set the PasswordManager user’s

password to a known value.

12

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
3

In Trusted Net Areas, click

Activate to unsuspend the user

13

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
4
In the Vault folder under Password Manager, run the command: CreateCredFile.exe user.ini

14

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
5

15

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 • In the event the PTA connectivity is not
working, we may need to resynch the
credentials for the PTA Vault users, as well
as the credentials stored in the
PTA_PAS_Gateway account (used for
REST calls between PVWA and PTA).
• This can be done easily by running the
VaultPermissionsValidation.sh script
located in the utility folder on the PTA
server.
• You can navigate to the utility folder by
entering the following alias:
UTILITYDIR
16

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 Common Issues
Related to CPM

17

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

 Local Computer Policy
• The Platform and Master
Policy settings must not
conflict with the password
policy on the target device

18

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 Understanding the problem:
• Verify / Change / Reconcile
• API and “net use” command
• Alternative plugins: WMI
plugin / PowerShell plugin
Suggested Troubleshooting:

• Check Windows Event Syntax:

Viewer net use \\<target IP address>\IPC$ /user:<domain>\<username>
• Check for unusual Local
Security Settings
• Run “net use” manually from 19

the CPM server to verify the

connection
Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com
cyberark.com
 Understanding the problem:
• Which operations are
affected: Verify / Change /
Reconcile / All

Suggested Troubleshooting:

• Running plink manually

• Disable DEP / add exceptions Syntax:
for DEP on the CPM server C:\Program Files (x86)\CyberArk\Password
Manager\bin\plink.exe <target IP address> -ssh -P <port>
• Prompts and Process files –
add a basic prompt
20

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 Common Issues
Related to PSM

21

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

 Understanding the problem

► At what stage does the problem occur? PVWA / PSM / Target

► One account? Multiple accounts? Same type?

► Is the PSM hardened?

► Is the PSM in a domain?

► Which connection type is being used? RDP file / RemoteApp

► If there are multiple PSM servers, are they distributed or load balanced?

22

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

 Suggested Troubleshooting:

► Check the PSM service – is it off/hanging?

► Logs and events on PSM server (System and Application)

► Disable NLA on PSM and target

► Initiate a manual connection with PSMConnect and run MSTSC to the target

► Check safe permissions (compare with other safes)

► Disable recording and auditing

► Check PSM Protocol version

► Increase Time-out values

23

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

 Network Level Authentication (NLA)
requires the connecting user to authenticate
themselves before a session is established
with the server.
You can disable NLA in order to determine if
that is causing the problem.
• On the PSM Machine or Target Machine:
Go to Control Panel → System and
Security → System → Remote Settings

24

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 To manually test the PSMConnect user
1. Go to the local Computer Management
(or Active Directory) and disable the
Start Program in the Environment tab.
2. Get the PSMConnect account password
(using the PVWA or PrivateArk Client).
3. Connect to the PSM with PSMConnect
and run MSTSC to the target.

25

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 • Timeout parameters
determine how long the PSM
will wait for certain
components to work before
considering them as ‘failed’
and ending the session.
• Overloaded environments
may suffer from longer times
for certain components to
begin working, so it is
recommended to double (e.g.) ConnectionComponentTimeout: 20000
their timeout values.

26

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 Understanding the problem:
• PSM users (PSMConnect / Shadow users)
• Is it supported?
• Is Mapping drives enabled?

Suggested Troubleshooting:

• Same recommendations as for PSM-RDP

• Run component manually using shadow
user
• Delete Shadow users (from PSM computer
management)
• Adjust AppLocker (or remove it manually in 27

Windows for isolation)

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com
cyberark.com
 Shadow users are created by
the PSM upon first connection.
Shadow users are used to run
connection components and
store user preferences.
You can isolate problems
related to shadow users by:
• Running the component
manually as the shadow user
(after password reset)
• Deleting the user (this will
allow the PSM to create the
user again) 28

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

cyberark.com
 The PSM uses the Windows
AppLocker feature which defines
a set of rules that allow or deny
applications from running on the
PSM machine.
When adding a new component,
you must also adjust AppLocker
by:
• Adding an exception to
PSMConfigureApplocker.xml
– Uncomment the line relating to
the new component
• Running the
PSMConfigureApplocker.ps1 29

script
Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com
cyberark.com
 You can also disable AppLocker entirely
(for isolating the problem only) using the
MMC snap-ins:
1. On the Start screen, type secpol.msc or
gpedit.msc

2. Go to Computer Configuration → Windows

Settings → Security Settings → Application
Control Policies → AppLocker

3. Click on Configure rule enforcement and set

Executable Rules to Audit Only

30

4. Turn Enforce rules back on after testing

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com
cyberark.com
 Summary

31

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com

Summary
In this session we covered basic
troubleshooting steps to resolve common
issues related to:

User authentication

Component connectivity to the Vault

Automatic password management

by CPM

Launching privileged sessions via

PSM

Copyright © 2021 CyberArk Software Ltd. All rights reserved. cyberark.com