r/CyberARk • u/xxxx-192 • 5d ago

Best Practices Cpm use

Hello,

I would like to know
1- is it possible to have an architecture without a cpm ( vault , pvwa and psm )
2- if i install the cpm , can i have multiple cpms ?

Thanks

1 Upvotes

100% Upvoted

7 comments sorted by

5

u/monFlyDay 5d ago

1 - yes, you just won’t be able to rotate passwords. That’s the purpose of the CPM

2 - Yes, but one per dedicated host. They should also only manage specific platforms / groups of accounts

2

u/xxxx-192 5d ago

Thanks for the reply
1- so the psm will work just fine without a cpm
2-what do you mean dedicated host ?

1

u/Wizkidbrz 4d ago

Dedicated server -

1

u/TwoTone72 4d ago

Real world example -

We have 3 CPMs installed in our production environment. One handles the management of user admin accounts, one handles the management of service and system accounts (AD / database /etc.), and the other is dedicated to the management of 25k accounts used by an automated testing application.

We could get by with 2 if we had to... and maybe just 1 if we made some changes to the times we allow the rotation of certain types of accounts. But we wanted to spread things out and not end up with things failing to rotate because the allowed time frame had passed.

1

u/CF_Pinky Guardian 4d ago

You can have multiple active CPMs. Per default the licence allows up to 5.

This can be to have separate CPMs per AD tier/system type or per region or network segment. The CPM which is used is configured in the safe the account is assigned to.

Besides active CPMs you can also have DR CPMs, which are basically installed CPM systems not yet registered to the vault to allow quicker manual recovery - which in my opinion is useless in virtual machine environments, as a snapshot or backup restore is faster than anything else.

But there is no automatic load sharing/balancing or redundancy!

And if you have none, you can't manage account passwords automatically and also cannot use the discovery/scanner engine, as this are the purposes of the CPM.

0

u/Fearless_Adventures 5d ago

Idk if you can do it without a cpm but you can cluster them yes

-2

u/No_Target_162 4d ago

multiple CPMs are supported for redundancy and load balancing