Description
Manage RealVNC Passwords
Vendor
This platform is designed for remote account management for the following target:
| Vendor | RealVNC |
|---|---|
| Product | Server |
| Product Category | Remote Access |
| Product Versions | 7.6.1 or higher |
CyberArk
This platform works with the following CyberArk versions:
| CyberArk Solution | Privileged Credentials Management |
|---|---|
| CyberArk Product | Central Policy Manager (CPM) |
| CyberArk Versions | CPM v10.10 or greater |
| Artifact Version | 1.0 |
| Out of the Box | NO |
| Out of the Box in versions | N/A |
| Available in Privilege Cloud | YES |
Support & Certification
| Support Level | STANDARD |
|---|---|
| Developed by | CyberArk |
| Certification Level | CERTIFIED |
| Connection Methods | PowerShell Remote Session |
Actions
The following table lists the supported management actions for this platform:
| Action | Supported | Permissions |
|---|---|---|
| Verify | YES | Requires Associated Reconcile Account |
| Change | YES | Requires Associated Reconcile Account |
| Reconcile | YES | Requires Associated Reconcile Account |
| Delete | NO |
Linked Accounts
The following linked accounts are in use by the plugin.
Logon Account
| Supported | NO |
|---|---|
| Required | NO |
| Platforms | |
| Permissions |
Reconcile Account
| Supported | YES |
|---|---|
| Required | YES |
| Platforms | |
| Permissions |
Prerequisites
The following prerequisites are required on the machine that runs this plugin :
Reconcile account must be able to connect to the target RealVNC Server(s) via PowerShell Remote Session from the CPM Server.
Configuration
Platform Settings
Specify the following parameters at the platform level:
| Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| RealVNCMode | RealVNC Server mode | service, user, legacy -user, legacy -service | service |
Account Settings
Account Mandatory Parameters
Specify the following parameters on the account:
| Parameter Name | Description | Acceptable Values |
|---|---|---|
| Real VNC Type | 'Real VNC Type' uses the password object username attribute. It is displayed on the PVWA account view as 'Real VNC Type' Defines the type of target password | Password, GuestPassword, AdminPassword, InputOnlyPassword, ViewOnlyPassword |
| Address | Target RealVNC Server host address | Target Address (Due to a common issue with PowerShell remote sessions, using an IP address is recommended) |
Account Optional Parameters
Specify the following parameters on the account:
| Parameter Name | Description | Acceptable Values | Default Value |
|---|---|---|---|
| RealVNCMode | The target RealVNC Server mode; If set will override the RealVNCMode Platform parameter. | service, user, legacy -user, legacy -service | service |
Known Issues
The legacy RealVNC PSM Connector is incompatible with this platform.
Please use the updated RealVNC PSM connector located here: https://community.cyberark.com/marketplace/s/#a35Ht0000013FeaIAE-a39Ht000003ATcPIAW
The 'Real VNC Type' attribute is the relabeled Username attribute. It is displayed on the PVWA account view as 'Real VNC Type'
The following 'Real VNC Type' values are compatible with 7.6.1+ version of the RealVNC PSM connector:
‘Password’ Default VNC password
‘AdminPassword’ Administrative user able to bypass accept/reject prompts.
‘ViewOnlyPassword’ Password for a basic user able to observe but not interact.
Reference: https://help.realvnc.com/hc/en-us/articles/360002313698-vncpasswd-man-page#modes-0-4
The RealVNC Server service can be run as a Windows Service (service or legacy -service), or a specific user's session (user or legacy -user).
For more information about RealVNC server modes, click here.
- 'user', 'legacy -user', 'legacy -service' modes are not recommended.
- Most environments will only use service for the RealVNCMode parameter.
- If RealVNCMode is set to 'user' or 'legacy -user'; It is recommended to increase the values of the following platform parameters:
- MaximumRetries
- MinDelayBetweenRetries
- User mode indicates the RealVNC Server process (listening service) is only running under a specific user's environment.
- The associated reconcile account must be the same user under which the RealVNC Server service is running.
- If the user is not using an active session on the target RealVNC Server, the RealVNC server software may not be listening; This will cause the CPM Management action to fail.
- If using legacy; Real VNC Type must be: 'Password'
- RealVNC Server Authentication using Password can only be configured to use either 'Password' or 'legacy Password', not both.
RealVNC plug-in does not support the use or management of any of the following:
- RealVNC 'virtual mode' credentials
- RealVNC client or server certificates
- RealVNC SmartCard Authentication
- RealVNC with Radius or MFA Authentication
- weakpwd