u/MysticCyber26

Looking for best practices for deploying CyberArk PSM for non-domain joined Windows DMZ servers. we are considering deploying a dedicated PSM server in the DMZ. We are Privilege Cloud ISPSS.

Current environment:

• Windows DMZ servers are NOT domain-joined
• Admins currently access them using local Windows accounts

Questions:

1. What is the recommended CyberArk architecture for this scenario?
2. What outbound ports/connectivity are required from a DMZ PSM server to the CyberArk Vault in Privileged Cloud?
3. Any special considerations for installing/configuring the RDS role on a non-domain-joined PSM server?
4. How are PSMConnect and PSMAdminConnect typically configured in non-domain joined environments? Local accounts on the PSM server?

Would appreciate hearing real-world implementations, lessons learned, or any architecture recommendations