cyber-ark

CPM is abke to login and verify a password however isn't able to change the password


I'm facing a very peculiar situation. While interacting with a windows server, I can see that CPM can login to the server and verify it however it's throwing the error when I click on the 'change password' button. Any help is greatly appreciated.


Solution

  • 1.Check that the account is not locked out. Check that you are able to run the following command from the CPM machine: net use \machine_name\ipc$ /user:. If you can't then you have a connectivity issue between the CPM machine and the host it is trying to change the password on (is the host in DMZ?). Check that the user does not have "user cannot change password" enabled under Local Users and Groups. 2.Check your Windows Domain policy for any restrictions such as Maximum password age, Minimum password age, Minimum password length etc. An easy way to verify if this is the case is to set the "User must change password at next logon" check box on the user's properties on the Windows machine. Once you set this, click on re-enable through the Password Vault Web Interface and allow the CPM to retry. 3.Check that the user that you're trying to change the password for has the ability to access the computer from the network: Start | Run | secpol.msc | Enter Local Security Settings | Local Policies | User Rights Assignment | Access this computer from the network. Verify that the user is listed or is a member of one of the groups that are specified in the list. Note: If the Security Policy can not be changed, then a Logon Account with permission to access the computer remotely can be associated to the password object as its logon account. 4.Make sure that "Network access: Sharing and security model for local accounts" is set to "Classic - local users authenticate as themselves: Start | Run | secpol.msc | Enter Local Security Settings | Local Policies | Security Options | Network access: Sharing and security model for local accounts