2.2 Vault Administrative Utilities & PARClient Commands

2.2 Vault Administrative Utilities & PARClient Commands

Quick Answer: CyberArk provides two primary low-level administrative utilities: the graphical PrivateArk Client (used for direct database, Safe, licensing, and raw log administration) and the command-line utility PACLI (pacli.exe / PARClient, used for headless scripting and automation). Both tools operate over TCP port 1858 directly against the PrivateArk Server engine, bypassing PVWA Master Policy constraints and dual-control approval workflows.

---

PrivateArk Client GUI Architecture & Operations

The PrivateArk Client is a 32-bit thick-client administrative console installed on designated management jump hosts or on the Vault server during staging. It establishes direct encrypted sessions over TCP port 1858 using the proprietary PrivateArk RPC protocol. While daily credential access and password rotations occur via the Password Vault Web Access (PVWA) web portal, the PrivateArk Client remains essential for low-level system operations, recovery procedures, and emergency maintenance.

Key Administrative Functions in PrivateArk Client

1. Safe & Container Management: Administrators can create, configure, and delete Safes, inspect file structures, and view raw folder hierarchies. Unlike PVWA, PrivateArk Client displays raw file objects, version histories, and low-level metadata.
2. Granular Safe Authorizations (ACLs): Key Safe-level permissions configured in PrivateArk Client include:
   • Manage Safe: Modifies Safe properties, retention settings, and user access.
   • Backup Safe: Authorizes backup utilities and replication agents against the Safe.
   • View Audit: Permits reviewing historical access logs for objects in the Safe.
   • Access Safe without Confirmation: Bypasses dual-control approval requirements when retrieving credentials.
   • Retrieve, Store, and Delete Files: Grants specific object manipulation rights.
3. License File Administration: Inspecting active license parameters (license.xml), reviewing allocated user licenses against quotas (e.g., EPVUser, CPM, PSM, AppProvider), and uploading updated license files.
4. Audit Log Inspection: Directly opening and reviewing italog.log and Safe activity logs without relying on web services or SIEM forwarding.
5. Directory Mapping & User Administration: Creating internal Vault users, defining administrative groups, configuring LDAP directory mappings, and managing administrative credentials.

PrivateArk Client vs. PVWA: The Exam Distinction

---

PARClient / PACLI Command-Line Architecture

The Privileged Access Command Line Interface (PACLI), also known as the PARClient CLI utility, is an administrative executable (pacli.exe) providing scriptable command-line access to the PrivateArk Server over TCP port 1858.

The Mandatory PACLI Session Lifecycle

PACLI is a stateful command engine. Automation scripts must strictly execute its six-stage lifecycle:

1. INIT: Allocates internal memory buffers, socket handlers, and API libraries.
2. DEFAULT: Defines session constants, including default Vault name, user identity, and timeout thresholds.
3. LOGON: Establishes an authenticated session against the Vault database, receiving a session authorization token.
4. Command Execution: Dispatches administrative commands (CREATESAFE, ADDFILE, FINDFILES, etc.).
5. LOGOFF: Invalidates the session token, releases database locks, and records an audit logoff event.
6. TERM: Releases memory allocations and cleanly closes network sockets.

# Standard PACLI Execution Pattern
pacli INIT
pacli DEFAULT VAULT="ProductionVault" USER="PACLIAdmin"
pacli LOGON VAULT="ProductionVault" USER="PACLIAdmin" CRED="C:\Keys\admin.cred"
# [Administrative operations executed here]
pacli LOGOFF VAULT="ProductionVault" USER="PACLIAdmin"
pacli TERM

Credential Security: CreateCredFile.exe Integration

Hardcoding plaintext administrative passwords inside batch, shell, or PowerShell scripts creates a critical security risk. CyberArk requires administrators to generate encrypted credential files using CreateCredFile.exe:

CreateCredFile.exe C:\Keys\admin.cred Password /Username PACLIAdmin /Password SuperSecret123! /Hostname ADMIN-MGMT-01 /AppType PACLI /Exe C:\CyberArk\PACLI\pacli.exe

This utility binds the resulting .cred file to:

• The specific machine hostname (ADMIN-MGMT-01).
• The designated executable binary hash (pacli.exe).
• The local operating system user running the process.

If an attacker copies the .cred file to an unauthorized machine, the Vault rejects the authentication token.

---

Syntax and Usage of Core PACLI Commands

1. CREATESAFE

Provisions a new Safe container, assigning its managing CPM and description:

pacli CREATESAFE VAULT="ProductionVault" USER="PACLIAdmin" SAFE="Linux_Prod_Keys" DESCRIPTION="Production Unix SSH Keys" MANAGINGCPM="PasswordManager"

• SAFE: Unique Safe container name.
• MANAGINGCPM: Specifies the CPM user account assigned to manage accounts in this Safe.

2. UPDATESAFE

Modifies Safe properties, description, or version retention settings:

pacli UPDATESAFE VAULT="ProductionVault" USER="PACLIAdmin" SAFE="Linux_Prod_Keys" DESCRIPTION="Updated Production Keys" NUMOFVERSIONSRETENTION="10" NUMOFDAYSRETENTION="30"

• NUMOFVERSIONSRETENTION: Maximum historical versions retained per object.
• NUMOFDAYSRETENTION: Days deleted objects are preserved before purging.

3. ADDFILE

Encrypts and uploads a local file into a specific folder inside a target Safe:

pacli ADDFILE VAULT="ProductionVault" USER="PACLIAdmin" SAFE="Linux_Prod_Keys" FOLDER="Root" FILE="id_rsa" LOCALFILE="D:\Staging\id_rsa"

• FOLDER: Target folder within the Safe (root level is "Root").
• LOCALFILE: Path to the local file to encrypt and store.

4. GETFILE

Extracts and decrypts an object from a Safe, saving it locally:

pacli GETFILE VAULT="ProductionVault" USER="PACLIAdmin" SAFE="Linux_Prod_Keys" FOLDER="Root" FILE="id_rsa" LOCALFILE="D:\Restored\id_rsa"

• Essential for emergency offline secret extraction when web portals are unreachable.

5. FINDFILES

Queries the Vault database to locate objects matching specific patterns within a Safe:

pacli FINDFILES VAULT="ProductionVault" USER="PACLIAdmin" SAFE="Linux_Prod_Keys" FOLDER="Root" PATTERN="*.rsa" OUTPUT(NAME,SIZE,CREATIONDATE)

• PATTERN: Wildcard search expression.
• OUTPUT: Selects returned metadata fields (e.g., name, size, creation date).

---

Administrative Use Cases & Tool Selection Matrix

While modern deployments favor the PVWA REST API for routine automation, PACLI and PrivateArk Client are preferred in specific operational scenarios:

• Air-Gapped & Offline Maintenance: When web components are unavailable, PACLI executes directly on the Vault or from administrative jump hosts.
• Disaster Recovery Validation: Automated scripts query replicated DR Vaults to verify data integrity without disturbing PVWA production services.
• Bulk Safe Provisioning: Rapidly creating hundreds of departmental Safes and assigning CPM ownership prior to account onboarding.