CyberArk

Support & Certification

Description

Local agent for PSM Windows audit without administrative privileges.

Overview

PSM WinAudit Local Agent - V2:

• Performance and Stability Improvement.

PSM WinAudit Local Agent - V1.6:

• Support for windows local accounts (Fix).

PSM WinAudit Local Agent - V1.5:

• Windows logon\welcome message support.

PSM WinAudit Local Agent - V1.4:

• Fix AV false positive.
• Remove PSM windows server 2012 support

PSM WinAudit Local Agent - V1.3:

• Performance and Stability Improvement.
  
• Updated installer - Agent's DLLs.
  
• Audit traces
  
• PSM windows server 2012 support - Separate file

Local Agent on target machines that allows the PSM server to obtain full Windows audit & recording during RDP sessions without providing administrative privileges to the logged on user and SMB access via port 445 on the target machine.

Installation

PSM Server:

1. Login to the PSM server
2. Copy PSMRdpWLA.exe file from the PSMComponents folder in the zip file to the PSM installation folder\Components on the PSM server. (e.g. C:\Program Files\CyberArk\PSM\Components)
3. Configure AppLocker:
   • Open Powershell as Administrator from C:\Program Files (x86)\Cyberark\PSM\Hardening
   • Run notepad PSMConfigureAppLocker.xml
   • Towards the end of the PSMConfigureAppLocker.xml file, before the </AllowedApplications> tag, add the following lines:

                           <Application Name="PSMRdpWLA" Type="Exe" Path="C:\Program Files (x86)\CyberArk\PSM\Components\PSMRdpWLA.exe" Method="Hash" />

1. • In the same Powershell window run PSMConfigureAppLocker.ps1

Target Server: 

1. Login to the target server
2. Copy the files from the LocalAgent folder in the zip file to the target server and run the PSMLAInstaller.exe as administrator

PVWA:

1. Login to the PVWA website
2. Go to Administration > Configuration Options> Options > Connection Components
3. Locate the PSM-RDP component
4. Duplicate the PSM-RDP component by right clicking on it > Copy
5. Right click on Connection Components > Paste Connection Component
6. Navigate to the duplicated connection component and select it
7. Change the ID value-> ID: PSM-RDP-LA
8. Expand the connection component and select: Target Settings
9. Change Target Settings ClientDispatcher value-> ClientDispatcher: PSMRdpWLA.exe
10. Assign this connection component to the relevant platform by navigating to Administration > Configuration Options > Platform Management > Locate the relevant platform and select it > Click on Edit > UI & Workflows > Connection Components > Right click on Connection Components > Add Connection Component > Assign the ID: PSM-RDP-LA
11. Click on Save

Minimum OS requirements:

1. PSM component on Windows Server 2016
2. PAS Product version v11.6

Internal Information