Keycyte PAM 3.2 · Administrator Guide

Changing Passwords

Keycyte PAM can change the password of a vault account on the target system, or only update the password that is stored in the vault. You start these actions from the action menu (…) at the end of each row on the Password Vault page.

Before you begin, make sure that:

• You have the Edit permission for Password Vault.
• As an ADMIN, your permission level on the entry is modify or full_access. See Adding Accounts.
• To change a password on the target, the account type supports it (Windows Domain, Windows, Linux, MySQL or PostgreSQL) and the server has a working privileged account where one is needed. See Account Types.

Account Action Menu

Changing a Password on the Target

Change Password generates a new password that matches the account’s password policy, changes it on the target and stores it in the vault.

The account must have a password policy with a Length greater than 0.

To change a password on the target:

1. On the Password Vault page, click … in the row of the account and select Change Password.
2. Confirm Auto change password on target?.

Keycyte PAM changes the password and then logs in to the target with the new password before it stores it. The vault is updated only if this check succeeds. If the account is the main account of Windows service entries, the logon password of each service is also updated.

How the password is changed (by the account itself or reset with a privileged account) is set by Change Method in the password policy. For details, see Configuring Password Policies.

Setting a Password Manually

Use Manual Change when you know the new password, for example after the password was changed outside Keycyte PAM.

To set a password manually:

1. Click … in the row of the account and select Manual Change.
2. Enter the password in New Password and again in Retry Password.
3. Select Change on Targets to also change the password on the target system. Clear it to update only the password stored in the vault.
4. Click Change.

The new password must differ from the current password and must not be one of the previous passwords of the account. With Change on Targets, the password must also meet the requirements of the account’s password policy, and the account type must support password change.

Verifying a Password

Verify logs in to the target with the stored password and records the result. Use it to find accounts whose password was changed outside Keycyte PAM.

To verify a password, click … in the row of the account and select Verify. The result is shown in a message and recorded in the Password Manager log.

While a password change for the account is in progress, verify again after it finishes.

Retrying a Self Change

With the default change method, an account first tries to change its own password. If that fails for a lasting reason, for example because the target does not allow it, Keycyte PAM resets the account with the privileged account for the next 30 days instead of trying again. Such accounts show a Self change skipped tag next to their name; point to the tag to see until when and why.

To try the self change again before the 30 days end, click … in the row of the account and select Retry self change. The next rotation tries the self change again.

Viewing Password History

Every successful change adds a version to the password history of the account.

To view the history, click … in the row of the account and select History. The dialog lists previous versions with Version, Username and Change Date. To copy an earlier password, click the copy button in its row; this needs full_access.

Setting the Same Password on Several Accounts

To set the same password on several accounts:

1. Select the accounts on the Password Vault page.
2. Click Set password for selected (key icon) in the toolbar.
3. Enter the password in New Password and Retry Password.
4. Click Change.

The password is stored in the vault only; it is not changed on the targets. To change a password on a target, use Change Password or Manual Change for each account. A message shows how many accounts were updated; accounts that you are not allowed to change are counted as forbidden.

Finding Accounts by Status

To list accounts by the result of their last password operation, click Advanced Filter and select one or more values in Status: OK, Warning or Error. The same dialog filters by Name, Type, Servers, Roles, Tags, Password Policy and Description, and finds accounts that have no role (Not Assigned to Any Role), no server (Not Assigned to Any Server) or no policy (No Password Policy). Click Apply to filter.