This post is to summarize the steps how to configure a remote connection manager tool to integrate with CyberArk PSM. In this way, you can directly RDP into target server through PSM, without logging into PVWA. Basically, this post gives you a way to launch transparent connections to target systems using a standard RDP client application.
Related Post:
Microsoft Remote Desktop Connection (MSTSC)
- psm /u {Priv_Account_Name}@51Sectest.dev /a {PSM_Server_Name} /c PSM-RDP
- psm/u [email protected] /a 192.168.2.12 /c PSM-RDP
Windows 10 machines, Remote Desktop Connection might not have Program tab. Add the following line to the .rdp file: alternate shell:s:psm /u target-user /a target-address /c connection-component
Microsoft Remote Desktop Connection Manager
download RDCM here: https://www.microsoft.com/en-gb/download/details.aspx?id=44989
Search by google and found this link to download : https://www.scom2k7.com/downloads/rdcman.msi
To integrate RDCM with CyberArk PSM, it requires some configuration changes on RDP file object. This post lists least step you will need to follow to get RDCM working with PSM.
- Always prompt for password upon connection – Disabled
- Require secure RPC communication – Enabled (this should already be enabled as part of hardening.
- Require use of specific security layer for remote (RDP) connections – Enabled – Set to RDP.
You should now be able to use RADIUS challenge-response and CyberArk authentication with RDCM.
Give each entry a meaningful name to indicate the target device details.
Populate the Server name field with the text {PSM-Server-Hostname}
Enter a friendly name of your
choice in the Display name field.
Uncheck the Inherit from parent checkbox.
Populate the Start program field with this string as
shown in the sample screenshot below:
/c PSM-RDP
of the privileged account as defined in CyberArk; ie. MyUsernameAdmin
the destination server name as resolvable via DNS; ie.
PrintServer
shown in the sample screenshot below:
Uncheck the Inherit from parent checkbox
Enter your non-privileged AD account
username in the User name field
Enter the text 51Sec-ITPROSEC in the Domain
field
When you click to connect, you will enter the
password for your non-privileged AD account.
Notes: How to connect to RDP Console / admin mode:
If you choose connect to console / admin, PSM will deny the session.
-
Make a copy of the PSM-RDP connection component (lets call it PSM-RDP-ADMIN).
-
Set the “AlloweConnectToConsole” Value=Yes, Visible=Yes.
-
Add it to the desired platform
-
In RDP client where you specify the psm /u etc.. commands, change the /c to PSM-RDP-ADMIN
MobaXterm
MobaXterm also support PSM well. Here are all configuration steps in the screenshot.
Most important step is to configure Remote command “psm /u [email protected] /a 192.168.2.12 /c PSM-RDP“
Create a domain user account and save it into credential list.
mRemoteNG
Remote Desktop Manager Free Edition – Devolutions
How it is working for Devolutions RDM integrating with CyberArk PAM solution:
Below is an example diagram demonstrating how Remote Desktop Manager integrates with CyberArk’s PAM Solution
- The end-user attempts to access a privileged remote connection through RDM.
- RDM confirms that the end user’s certificate is valid.
- RDM connects to CyberArk and requests the necessary credentials.
- CyberArk accepts the request and sends the credentials to RDM.
- The credentials are used to grant the end-user access, so they can complete their work-related task.
PSM Integration
192.168.2.25 is PSM server ip address.
Here is the magic string:
- psm /u [email protected] /a 192.168.111.25 /c PSM-RDP
- [email protected] is the privilege account
- 192.168.111.25 – PSM server ip address
You will not need to grant following settings:
On the PSM server, no need to allow domain users to log on through RDS:
Other examples from CyberArk Docs
Note: Configure an RDP Start Program
Example 1: Windows server on RDP protocol
To connect to a Windows server with the address of 10.10.2.145, with the user admin and with the RDP protocol, use the following configuration in the Start Program setting:
|
To connect to a Windows server with the address of 10.10.2.145, which belongs to the domain mycompany.com, with the domain user domainadmin and with the RDP protocol, use the following configuration in the Start Program setting:
|
To allow the connection, a domain account with the address of mycompany.com and the username domainadmin must pre-exist in the Vault. |
To connect to a Unix server with the address of 10.10.2.145, with the user root and with the SSH protocol, use the following configuration in the Start Program setting:
|
To connect to a Unix server with the address of 10.10.2.145, with the user root and with the WinSCP client, use the following configuration in the Start Program setting:
YouTube Video:👀
References
- Configure an RDP Start Program
- How to connect through Privileged Session Manager for Windows using Remote Desktop Connection Manager