4.4 Loosely Connected Devices: Rotating Laptop & Workstation Credentials

4.4 Loosely Connected Devices: Rotating Laptop & Workstation Credentials

Quick Answer: A loosely connected device is an endpoint — typically a laptop — that is only intermittently reachable on the corporate network, so the CPM can never guarantee an outbound connection to it at rotation time. PAM - Self-Hosted solves this by delegating the rotation to CyberArk Endpoint Privilege Manager (EPM). The EPM agent installed on the endpoint pulls the pending credential from the PVWA over the internet instead of the CPM pushing it over SMB or SSH. The integration is configured in an EPM Credentials Rotation Policy, authenticated with a shared security key that must be stored in the Vault's SharedAuth_Internal Safe as a PrivateArk protected object.

---

Why Standard CPM Rotation Fails on Disconnected Endpoints

Every workflow covered so far in this chapter assumes the CPM can open an outbound session to the target: SMB/RPC on TCP 445/135 for Windows, SSH on TCP 22 for Unix, a listener port for databases. That assumption holds for datacenter servers on a routed internal network. It collapses for the endpoint estate:

• A field engineer's laptop may be off the corporate network for weeks, connecting only through a public café hotspot.
• A home-office workstation sits behind consumer NAT with no inbound reachability from the datacenter.
• A travelling executive's machine is powered off during the entire CPM verification window.

The local built-in administrator account on each of those machines is exactly the credential an attacker wants, because it is frequently identical across the whole fleet. Yet when the CPM tries to rotate it, the plug-in fails with a connectivity error, RetriesCount climbs to MaximumRetries, and the account is parked in an error state indefinitely. Left alone, the entire laptop fleet becomes a permanently non-compliant island inside an otherwise well-managed PAM program.

---

The LCD Architecture: Inverting the Direction of Rotation

CyberArk's answer is to reverse the direction of the connection. Instead of the CPM reaching into the endpoint, the EPM agent already running on the endpoint reaches out to the PVWA whenever it has any internet path.

The exam frequently probes the ownership question directly: in an LCD deployment the CPM never contacts the laptop. The CPM's role narrows to generating the new password and staging it; the EPM agent performs the actual local password change and reports the result back through the PVWA.

---

Prerequisites and Platform Coverage

Before any LCD account can be onboarded:

• EPM is mandatory. PAM - Self-Hosted cannot manage loosely connected devices without an EPM deployment; this is a licensing and architecture prerequisite, not an optional add-on.
• EPM agents must already be installed on the relevant endpoints.
• Platforms must exist for the target operating system. The Windows loosely connected device platform ships out of the box. The macOS and Linux loosely connected device platforms must be downloaded from the CyberArk Marketplace and imported before use.
• The PVWA must be at a version the agent supports (the agent requires PVWA v10.2 or higher).

---

Configuring the Credentials Rotation Policy

The integration is defined on the EPM side, in the EPM management console under Policies → Credentials rotation policies → Create credentials rotation policy. The policy's Password Vault block defines the PAM integration:

Optionally, a client certificate issued by the EPM server when the Credentials Rotation Policy is configured can be used to harden PVWA-to-agent communication beyond the security key alone.

Storing the Security Key in the Vault

The security key is the shared secret that lets the PVWA trust an agent it has never seen on the internal network, so it is stored inside the Vault rather than in a configuration file:

1. Log on to the PrivateArk Administrative Client as a member of the Vault Admins group.
2. Open the SharedAuth_Internal Safe.
3. From the File menu choose New → File → PrivateArk Protected Object.
4. Create the object with the Object Name EPM_PAS_Gateway, and paste the security key value copied from the EPM policy as the password.

Operational trap: whenever the security key is regenerated in the EPM policy, it must also be updated in the PrivateArk Client and synchronized to every EPM agent. Changing it in only one place silently breaks rotation for the entire fleet, and the symptom — accounts stuck pending with no CPM error — looks nothing like a normal CPM failure.

---

The LCD Rotation Flow, Step by Step

1. The account is onboarded to a Safe using a loosely connected device platform, exactly like any other account.
2. When the credential expires or an administrator triggers a change, the CPM generates a compliant password and stages it as a pending credential in the Vault rather than pushing it anywhere.
3. The endpoint eventually obtains any internet path. The EPM agent calls the configured PVWA server URL and authenticates using the security key. Two PVWA REST endpoints must be reachable for this to work: POST /PasswordVault/API/EPM/RetrieveEndpointPassword and POST /PasswordVault/API/EPM/NotifyEndpointPasswordChange.
4. The agent retrieves the pending credential for its own local account.
5. The agent applies the password change locally, against the local account on the endpoint.
6. The agent reports success back through the PVWA, and the pending credential is promoted to the active version in the Vault.

Because step 3 can occur days after step 2, an LCD account being "pending" is normal operational state, not an error. Administrators verify LCD health by checking the last successful change timestamp against the agent's last check-in, not by looking for CPM plug-in errors.

Scope Limits Worth Memorizing

The EPM credentials rotation policy manages local accounts in a fixed set of system groups that is not configurable in the policy:

Three further limits are worth memorising, because each one is a plausible exam scenario:

• Change is the only supported action. Verify and Reconcile are not supported for loosely connected devices, so an LCD account never shows a verification timestamp.
• Local accounts with dependencies (usages) — Windows services, scheduled tasks, IIS application pools — are not managed, and neither are local accounts that belong to an account group.
• The Linux agent manages passwords only; SSH keys on loosely connected Linux endpoints are out of scope.

LCD is therefore not a general-purpose replacement for CPM rotation: domain accounts, service accounts with dependencies, and server-class targets all remain CPM-managed through the standard change/verify/reconcile state machine described in section 4.2.