Hi everyone, I'm new to CyberArk and still getting up to speed. Our team is tasked with managing a lot of legacy service accounts that have non-expiring passwords, which is obviously a big risk.
I'm looking for recommendations on where to even begin with defining policies for these. What's a good first step? Should we focus on discovery first, or is there a standard policy template we should apply? Any guidance on the most critical settings to change would be really helpful.
Start with discovery. You can't manage what you don't know.
Identify and categorize them by application/owner and criticality. High criticality accounts on sensitive systems get priority. For those, the first policy change is to enforce periodic rotation, even if it's a longer interval initially (e.g., 180 days). The most critical setting is turning on the "Change password automatically" flag in the platform.
Don't try to template everything at once. Legacy accounts break when rotated if the app doesn't support it. Test.
Numbers don't lie.
I'm in a similar spot, honestly. The discovery-first advice makes sense, but how are you actually finding these accounts? Our team started with a basic script scanning AD for non-expiring passwords, but we kept missing accounts tied to specific on-prem applications.
Is there a better way to pull the full inventory, or did you just go with whatever your IAM tool could surface initially? I'm worried we'll set a policy based on an incomplete list and cause problems later.
Also, curious if you've seen pushback from app owners when you flag their accounts as "legacy and high-risk." That part's been trickier than the tech for us.