Symantec Privileged Access Management

Is really necessary to install windows proxy, i mean in which situation would have to install it? 

Hi Adolfo,

A Windows Proxy is NOT *required* for PAM to work, but there are a few features that only work if you are using one:

• Rotating passwords of Local Windows accounts (non-domain accounts)
• Rotating passwords of Service Accounts in Windows
• Managing Services
• Managing Scheduled Tasks

I would suggest reviewing the following documentation pages for more specific information on this:

Windows Proxy Target Connector - CA Privileged Access Manager - 2.8.3 - CA Technologies Documentation 

Install a Windows Proxy for Credential Manager - CA Privileged Access Manager - 2.8.3 - CA Technologies Documentation 

Hope this helps!

-Christian Lutz

Support Engineer

CA Technologies - North America

Thanks for the fast response, but it mean if i do not have a Windows Proxy i can't manage windows account both local and domain? I have a lab with PAM and some types of endpoints with the accounts provisioned, in this scenario i would have to use a Windows Proxy? 

Thank You!

Adolfo Navarro M

Hello Ralf,

Please, can you tell me, if the Windows Proxy Software have to be installed in each endpoint where i need to manage accounts?

Thank You.

Regards.

Adolfo.

Please refer to the table at the link below to figure out how many proxies you may need:

Install a Windows Proxy for Credential Manager - CA Privileged Access Manager - 2.8.3 - CA Technologies Documentation 

-Christian Lutz

With out windows Proxy you cannot manage local accounts of windows servers.So basically you need proxy if you wish to manage windows local account.Now coming to the point ho many of them you need.

If the endpoint belongs to same domain then you need probably 1 proxy or 2 for fault tolerance, however if the endpoint are not part of domain(ie if it belongs to workgroup or different domain) then you would need proxy in each endpoint.

Really it would depend on what your specific needs are. As I stated above the Proxy is required for "rotating passwords" (which includes "verifying passwords" as well) on local accounts. 

That being said, if you are NOT interested in "rotating or verifying passwords", you could use a Generic type target application instead which would only allow you to store a static Target Account in the password vault and use it for Auto Logins or Viewing.

-Christian Lutz