AutoSys Workload Automation

We have CA Workload Automation AE 11.3.6.  We have a need to automate the changing of the passwords for the Windows ID's.  We have CyberArk PPM and AIM in our environment.  Has anyone used CyberArk to manage the passwords for jobs running on Windows servers?

I am interested in this thread because we are in a similar position, only with ESP.  Here is our roadmap:

1. Utilize the PASSWORD command to store passwords for batch IDs in ESP for Windows jobs ( UNIX uses setui, also not sure what the equivalent in Autosys is).

2.  Utilize esplmi as a "framework" to automate the management of the passwords (enter, alter, delete) in ESP using the password command.

At this point, we are not sure exactly how this will be accomplished.  We are evaluating whether to script this on a distributed system, or use JCL for it.  In the end, once it gets automated, either a simple file dependency or perhaps a web services job could be used.  The key question for us is, how will CyberArk "trigger" a job / application to run?

Hope this helps!

CyberArk should be able to run a script after resetting the password to then interact with autosys_secure and update the password. We use it to automatically update passwords for windows accounts, and also for admin level EEM accounts and it's all done without any manual intervention from our side (most of the time anyway).

Hello

If the password of the owner of an Autosys job on Windows changes, you must change the password of this Windows user with autosys_secure.

You can run a autosys_secure from the command line or in a script to pass the new password. In short, there is no need to run autosys_secure in interactive mode.

See: Autosys_Secure password change

autosys_secure options to use are:

• -c -u {user@host | user@domain}  - o {NULL|old_password}  - p {NULL|new_password}  
  (Optional) Changes the password for the specified user. To remove a password, specify a value of NULL for the -p parameter. To add a password, specify a value of NULL for the -o parameter.

Changing the password requires the old password. If for security reason you are not allowed to keep track of any old password, the other way will be to delete the user and create a new one with its new password.

Regards

Jean Paul

Hi Shawn

Are you OK with the autosys_secure steps? 

Does it answer your question?

Regards

Jean Paul