1.2 Vault OS Hardening, Network Isolation & Port Requirements

1.2 Vault OS Hardening, Network Isolation & Port Requirements

Quick Answer: The CyberArk Digital Vault is a dedicated security appliance built on Windows Server, hardened via automated PowerShell scripts that eliminate non-essential services, roles, and protocols. The Vault must remain a standalone Workgroup server and never join an Active Directory domain, preventing domain-level compromises (such as Golden Tickets or compromised Domain Admins) from affecting the Vault host. Network isolation is enforced by the Windows Defender Firewall, which blocks all inbound traffic except TCP port 1858 from authorized component IPs, while disabling remote access protocols including RDP and SMB.

---

The Standalone Workgroup Mandate

A foundational requirement on the CyberArk PAM-DEF exam is that the Digital Vault server must NEVER be joined to an Active Directory (AD) domain. It must always operate as a standalone server in a local Windows Workgroup.

The technical justifications include:

• Eliminating Transitive Privilege Escalation: If the Vault were domain-joined, Active Directory Domain Admins would automatically gain membership in the Vault local Administrators group. Any attacker who compromised a Domain Controller or forged a Kerberos Golden Ticket would obtain administrative control over the Vault host operating system.
• Preventing Group Policy Overrides: Domain-joined servers apply Group Policy Objects (GPOs) from domain controllers. Malicious or misconfigured enterprise GPOs could overwrite CyberArk local security policies, re-enable disabled services (such as SMB or Remote Registry), or weaken audit logging.
• Eliminating Domain Protocol Vulnerabilities: Operating in a domain forces participation in Kerberos and NTLM handshakes, exposing the Vault to credential relay attacks, Kerberoasting, and memory-based ticket extraction.

Directory integration for user authentication is performed at the application layer, not the OS layer. The Vault acts as an LDAP/LDAPS client querying Active Directory over TCP port 389/636, remaining an isolated cryptographic island at the host OS level.

---

CyberArk OS Hardening Framework

During and after installation, CyberArk executes automated hardening scripts (Hardening.ps1 and PostInstall.ps1, alongside security templates) to strip Windows Server down to a least-privilege appliance profile.

1. User Rights & Local Policies

• Deny Network Access: The Access this computer from the network right is revoked for standard accounts, while Deny access to this computer from the network is enforced.
• Console-Only Logon: Logon rights are restricted strictly to Allow log on locally at the physical or hypervisor console for the local Administrator.
• Deny Remote Desktop: The Allow log on through Remote Desktop Services right is cleared, and Remote Desktop is disabled.

2. Registry Hardening & Protocol Lockdown

• Protocols Disabled: SMBv1, SMBv2, NetBIOS over TCP/IP, and LLMNR are deactivated across all adapters.
• Authentication Standards: LanManager and NTLMv1 are blocked, enforcing strict NTLMv2 with 128-bit minimum session security.
• Anonymous Enumeration: Strict settings block anonymous enumeration of SAM accounts and shares (RestrictAnonymous = 2).

3. Disabling Non-Essential Services

Windows services outside the core PrivateArk engine are disabled:

Automatic Windows Update reboots are disabled via local policies; OS patching requires manual maintenance and database health verification.

---

Vault Network Isolation & Firewall Architecture

CyberArk takes complete control over the native Windows Defender Firewall:

1. Inbound Lockdown: All default inbound rules are removed. The firewall blocks all unsolicited inbound packets across all interfaces.
2. The Sole Inbound Exception: A single inbound rule permits TCP port 1858 (PrivateArk Server), strictly restricted to static IP addresses of authorized CyberArk components (PVWA, CPM, PSM, PSMP, AAM, DR Vault). Packets from unlisted IPs are dropped.
3. Outbound Lockdown: All outbound traffic is blocked by default, with exceptions explicitly defined in DBParm.ini.

Authorized Outbound Integration Ports

Specific outbound rules support enterprise integrations:

• SIEM / Syslog: UDP 514, TCP 514, or TLS 6514 outbound to SIEM platforms (Splunk, QRadar, Sentinel) for real-time audit streaming.
• NTP: UDP 123 outbound to time servers. Clock skew exceeding 5 minutes invalidates MFA tokens, SAML assertions, and Kerberos tickets.
• SNMP Traps: UDP 162 outbound for operational monitoring alerts.
• RADIUS MFA: UDP 1812 or 1645 outbound for multi-factor authentication.
• SMTP Alerts: TCP 25 outbound to internal mail relays for Event Notification Engine (ENE) notifications.
• LDAP / LDAPS: TCP 389 / 636 outbound to Domain Controllers for user authentication.
• DR Replication: TCP 1858 between DR Vault and Primary Vault (DR Vault initiates inbound to Primary).

---

Component Port Requirements Matrix

The port topology across the PAS ecosystem is a primary focus on the Defender exam: