CyberArk PAS Solution Issues and Troubleshooting (PVWA)

Reports Fail When Run As Administrator

It is relating to DR replication error. here is log found from active Vault server. Log can be found from this file: C:\Program Files (x86)\PrivateArk\Server\Logs\italog.log

Note: Server 192.23.1.25 is PVWA

Issue can be fixed based on CyberArk Article:
PVWA – How to create / update credential files for PVWA manually?

for problem psm server:

• check username in psmapp.cred and psmgw.cred 
• use command at problem psm server to change password
• update users’ password in the vault

same process for pvwa server users.

• check appuser.ini and gwuser.ini under folder : C:\CyberArk\Password Vault Web Access\CredFiles
• You will find user name in those two files.
• use command at problem pvwa server to change password
• update users’ password in the vault

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe appuser.ini
Vault Username [mandatory] ==> PVWAAppUser1
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==> PVWAAPP
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User/No) [No] ==> Machine
Command ended successfully

C:\CyberArk\Password Vault Web Access\Env>CreateCredFile.exe gwuser.ini
Vault Username [mandatory] ==> PVWAGWUser1
Vault Password (will be encrypted in credential file) ==> *********
Disable wait for DR synchronization before allowing password change (yes/no) [No] ==>
External Authentication Facility (LDAP/Radius/No) [No] ==>
Restrict to Application Type [optional] ==>
Restrict to Executable Path [optional] ==>
Restrict to current machine IP (yes/no) [No] ==>
Restrict to current machine hostname (yes/no) [No] ==>
Restrict to OS User name [optional] ==>
Display Restrictions in output file (yes/no) [No] ==>
Use Operating System Protected Storage for credentials file secret (Machine/User/No) [No] ==> Machine
Command ended successfully

C:\Windows\system32>iisreset

Attempting stop...
Internet services successfully stopped
Attempting start...
Internet services successfully restarted

After rebooted both DR and main  PSM & PVWA servers, system finally got back into healthy status.

LDAP Log In without Entering Domain Name

1. Login
   to PVWA with an admin account
2. Navigate
   to: Configuration options>LDAP integration>LDAP
3. Change
   AddDomainToUserName to No
4. Make
   sure it saves

Change Windows Local Admin Account Denied

Error in changepass operation to user 172.2.1.12\tmpadmin on domain 172.2.1.12(\\172.2.1.12) with logon account. Reason: Access is denied. (winRc=5). Logon account details – Safe: Win-Logon-Reconcile-ISO, Folder: Root, Object: Operating System-WinSrvLocal-172.2.1.12-appadmin The CPM is trying to change this password because its status matches the following search criteria: ResetImmediately.


Winrc=5 : This error typically happens when the account does not have permission to perform change. Does the user have permission to change its own password ?

SOLUTION:

Reference: https://cyberark-customers.force.com/s/article/00003277

Note: If you are using a local admin account as logon account , you will need to make this policy change. But if you are using domain admin account, this step is not necessary.

There is another workaround for this issue:
Go to platform , edit , right click Automatic Password Management, Additional Policy Settings , change ChangePasswordInResetMode from no to Yes.

This will enable change password behavour to be done by reconcile account. It is on platform level. You will have make sure your account has a reconcile account associate with it.

Change Win Account Password Failed 

Failed because the password does not meet the password policy requirements.

Error in changepass operation to user 172.2.1.12\tmpadmin on domain 172.2.1.12(\\172.2.1.12) with logon account. Reason: The password does not meet the password policy requirements. Check the minimum password length, password complexity and password history requirements. (winRc=2245). Logon account details – Safe: Win-Logon-Reconcile-ISO, Folder: Root, Object: Operating System-WinSrvLocal-172.2.1.12-appadmin The CPM is trying to change this password because its status matches the following search criteria: ResetImmediately.

Winrc=2245: This error happens when there are restrictions like minimum password length, password complexity and password history requirements. In this scenario you could use a reconcile account which permission to reset target account in question. Basically you are using Recon account to reset password of other accounts.

For me, I am violating this minimum password age 1 days policy rule. I waited one day to test it again and it works.

PVWA login : Your session has expired

Tried to log in PVWA and got this error. Tried a different account and still same.

Solution is simple, iisreset on PVWA server.

ITATS450E Owner xyz is the quota Owner of Safe

https://cyberark-customers.force.com/s/article/00000991

PVWA Prompted to Change LDAP Login Password

CyberArk will check your LDAP login’s expiration date and by default, if it found it will expire in 7 days, it will ask you to change it.

The settings are in following page. It is at Options -> Authentication Methods -> Generalsettings ->AllowPasswordChangeInNonCyberArkAuth 
The AllowPasswordChangeInNonCyberArkAuth parameter determines whether or not users who are logged on with LDAP authentication will be able to change their passwords.


The PasswordExpirationNotificationDays defines the number of days before the password expires that the user will be notified (relevant only for CyberArk authentication). To cancel this notification, specify -1.