r/CyberARk • u/AdElectrical9508 • 1d ago
Rotation failure
Hello everyone,
We have password rotation configured in our CyberArk PAM Self-Hosted environment.
Initially, we configured the password rotation interval to every 15 days, and later changed it to 30 days.
We noticed that one of the users was rotated after 32 days. However, the password rotation did not succeed, and we received an error indicating that the account was expired, locked, or invalid.
We checked with the AD team, and they confirmed that the user is not locked, expired, or invalid on their side.
From the CyberArk/PAM side, what could be causing this issue? What should we check in the CPM logs or configuration to identify the root cause?
Has anyone experienced a similar issue?
Thank you.
1
u/TheRealJachra 1d ago
You should start looking into the pmerror.log. And start from there. Maybe the CASOS trace log can help you.
Otherwise monitor to see if it happens again. And you could change the debug level for the CPM.
1
u/Visual-Bonus4876 1d ago
my recommendation:
If this is domain:
platform settings:
---Automatic Password Management
------Additional Policy Settings
---------UnlockUserOnReconcile: Yes
---------ChangePasswordInResetMode: Yes
if these are not set for active directory accounts, when CyberArk performs a change operation, it will attempt to use the vaulted account to change the password, if the account is locked out in AD at the time it attempts it, it will fail and this will happen.
with these settings configured, CyberArk will use the reconcile account for both change/reconcile operations, and if the account is locked during that event, it will also unlock it in Active Directory.
this wont prevent it from locking out in AD, so the source of the lockout needs to be found by checking SIEM logs or AD logs for eventID 4740 to locate the source of the offending session or credential that is triggering the lockout.
1
u/The_IVth_Crusade Sentry 1d ago
Can you post the complete error message including the error code. Sometimes the message itself is misleading but it is taken directly from what windows provides. The code sometimes will identify the real issue (different codes can produce the same message)
Also are you sure the user does not have the account checked out so is locked to the user rather than locked in AD?
Also to remove any doubt in such situations cyberark has functionality to unlock on reconcile which requires read lockout time and write lockout time permissions on the account. If it is truly locked in the domain this would unlock it.