CyberArk PSM direct RDP with domain account and dynamic target address
Hi,
I'm trying to create a custom .rdp file to connect directly through CyberArk PSM, without going through PVWA.
Direct PSM connection itself is working fine with Windows Local Account, including authentication with my local CyberArk Vault user.
My issue is with a domain account that can be used to connect to multiple target servers.
The account stored in CyberArk looks roughly like this:
Username: admin_domaine_XXX
Address: DOMAINE.NET
Log On To : DOMAINE
In PVWA, when I click Connect, I get a prompt where I can freely enter the actual target address, for example, thanks to Allow User Connections to Other Machines option :
SRV001.DOMAINE.NET
The same domain account can therefore be used against multiple servers.
For a direct PSM RDP connection, CyberArk documentation gives this kind of syntax:
psm /u domainadmin@mycompany.com /a 10.10.2.145 /c PSM-RDP
So I tried the equivalent:
alternate shell:s:psm /u admin_domaine_XXX@DOMAINE.NET /a SRV001.DOMAINE.NET /c PSM-RDP
and
alternate shell:s:psm /u admin_domaine_XXX@DOMAINE /a SRV001.DOMAINE.NET /c PSM-RDP
However, this does not work.
PSM reports that the account cannot be found, and I understand the issue....
The only configuration that successfully finds the account is:
alternate shell:s:psm /u admin_domaine_XXX /a DOMAINE.NET /c PSM-RDP
But obviously, in that case /a contains the Vault account Address and not the actual server I want to connect to, si the connexion just instantly cut because DOMAINE.NET isn't a server..
So my question is:
How does PVWA pass the user entered target address to PSM when using a domain account whose Vault Address is the domain itself?
Is there another PSM parameter that allows me to specify separately:
Vault account identification:
admin_domaine_XXX @ DOMAINE.NET
Actual connection target:
SRV001.DOMAINE.NET
My goal is ultimately to reproduce the PVWA behaviour using a direct .rdp file, ideally while keeping the actual target server dynamic.
Has anyone implemented this successfully with PSM direct connections?