PowerShell automation scripts for CyberArk Privileged Access Manager (PAM) using the PVWA REST API.
cyberark-automation/
├── scripts/
│ ├── onboarding/ # Safe creation & member assignment
│ │ ├── CreateSafesAndAssignMembers_Secure.ps1
│ │ └── samples/
│ │ └── safes_sample.csv
│ ├── accounts/ # Account onboarding
│ │ ├── OnboardAccounts_Secure.ps1
│ │ └── samples/
│ │ └── accounts_sample.csv
│ ├── governance/ # Governance & telemetry reports
│ │ └── CyberArk-GovernanceReport.ps1
│ └── utilities/ # Shared helpers (coming soon)
├── docs/
│ ├── onboarding/
│ │ └── README.md
│ ├── accounts/
│ │ └── README.md
│ └── governance/
│ └── README.md
└── .github/
└── ISSUE_TEMPLATE/
Connects to the PVWA REST API, collects live vault telemetry, and generates a self-contained HTML governance dashboard — inspired by Sphereboard and PAS Reporter.
| Dashboard Section | What it shows |
|---|---|
| Executive Summary | Safes · Accounts · Users · CPM% · Issues count · Component health |
| 3 Live Charts | Account status donut · Platform bar · Top safes bar |
| Unmanaged Accounts | AutoManagement = false — passwords not rotated by CPM |
| CPM Error Accounts | CPM assigned but last operation failed |
| Never Verified | CPM managed but never successfully verified |
| Stale Passwords | Not changed in > 90 days (warn) / > 180 days (critical) |
| Safe Governance | Empty safes · Safes without CPM assignment |
| Platform Breakdown | Account count per platform with % distribution bars |
| Component Health | PVWA / CPM / PSM / PTA — connected / total / status |
| Recently Added | Accounts onboarded in the last 30 days |
# Run — report opens automatically in browser
.\scripts\governance\CyberArk-GovernanceReport.ps1Output: CyberArk-Governance-<timestamp>.html — single file, shareable via email or SharePoint.
See docs/governance/README.md for full configuration and permission requirements.
Reads a CSV and for each row:
- Verifies the target Safe exists (skips with warning if not — run safe onboarding first)
- Searches for an existing account by
SafeName+UserName+Address(idempotent)- Found → skips, or updates non-secret properties with
-UpdateExisting - Not found → creates the account
- Found → skips, or updates non-secret properties with
- Optionally triggers a CPM verify / change / reconcile immediately after creation
- Secrets handled via
[SecureString]andMarshal.ZeroFreeBSTR— never written to logs
# Dry run first
.\scripts\accounts\OnboardAccounts_Secure.ps1 # ($DryRun = $true in CONFIG)
# Live run
.\scripts\accounts\OnboardAccounts_Secure.ps1
# Live run + update existing accounts' properties (never overwrites passwords)
.\scripts\accounts\OnboardAccounts_Secure.ps1 -UpdateExisting| Column | Required | Description |
|---|---|---|
SafeName |
Yes | Target safe name |
PlatformId |
Yes | CyberArk platform ID (e.g. WinServerLocal, UnixSSH, Oracle) |
Address |
Yes | Hostname or IP of the target system |
UserName |
Yes | Privileged account username |
AccountName |
No | Custom vault display name (auto-generated if blank) |
Secret |
No | Initial password — leave blank to let CPM set it (recommended) |
SecretType |
No | password or key (default: password) |
AutoManagement |
No | true = CPM managed (default: true) |
ManualManagementReason |
No | Explanation when AutoManagement=false |
CPMAction |
No | verify, change, or reconcile triggered post-creation |
ExtraProps |
No | JSON object for platform-specific properties e.g. {"Port":"1521"} |
See scripts/accounts/samples/accounts_sample.csv and docs/accounts/README.md.
Reads a CSV file and for each row:
- Creates the CyberArk Safe if it does not already exist
- Assigns a fixed set of Vault-local members (
SCIM_User,Administrator,ISAdmin) with full permissions - Assigns the per-row LDAP user (
LanId) with end-user permissions - Assigns the onboarder service account (
aucaonboarddga) with onboarding permissions
| Requirement | Detail |
|---|---|
| PowerShell | 7.0+ recommended (-SkipCertificateCheck support) |
| PVWA | CyberArk v12.0+ REST API |
| Network | HTTPS access to the PVWA host |
| Permissions | The authenticating user must have Safe Management rights |
| Column | Required | Description |
|---|---|---|
SafeName |
Yes | Name of the safe to create |
LanId |
Yes | LDAP/AD username to add as a safe member |
See scripts/onboarding/samples/safes_sample.csv for an example.
# 1. Edit the CONFIG block at the top of the script
# - Set $PVWA to your PVWA URL
# - Set $LdapDirectory to your CyberArk directory mapping name
# - Set $CsvPath to your CSV file path
# 2. (Optional) Dry-run first — no changes made to the vault
# Set $DryRun = $true in the CONFIG block
# 3. Run
.\scripts\onboarding\CreateSafesAndAssignMembers_Secure.ps1| Role | Permissions granted |
|---|---|
Vault members (SCIM_User, Administrator, ISAdmin) |
Full — all permissions including ManageSafe, BackupSafe, AccessWithoutConfirmation |
| LanId (end user, LDAP) | ListAccounts, UseAccounts, UpdateAccountProperties, InitiateCPMAccountManagementOperations, ViewAuditLog, ViewSafeMembers |
Onboarder (aucaonboarddga, LDAP) |
AddAccounts, DeleteAccounts, UpdateAccountContent, UpdateAccountProperties, ManageSafe, ManageSafeMembers, InitiateCPMAccountManagementOperations, ViewAuditLog, ViewSafeMembers, ListAccounts |
- Never commit credentials — the script prompts interactively or accepts a
PSCredentialobject; no passwords in code $SkipCertCheck = $falseby default — only enable in isolated non-prod environments$DryRun = $true— always test against non-prod first- Credentials and tokens are zeroed out in
finallyblocks after use - HTTP status codes are inspected before any create/update action — non-404 errors are surfaced immediately
- Fork the repo
- Create a feature branch:
git checkout -b feature/my-script - Follow the existing coding conventions (explicit parameters,
Write-Log, try/catch with HTTP status checks) - Submit a pull request with a clear description
See CHANGELOG.md
MIT — see LICENSE