Has anyone switched back from CyberArk PAM to regular AD accounts?
Asked by
weekly.roster.
I'm curious if anyone has transitioned away from using CyberArk for managing accounts, returning to standard Active Directory accounts for admin or service access. In our case, we've found that CyberArk adds a significant amount of operational complexity. The processes involved, like checkouts and password rotations, sometimes hinder our troubleshooting and daily operations. We're starting to wonder if the added intricacy is really worth it for us.
Answers
Consider implementing certificate-based authentication or a YubiKey with script access enabled for accounts, plus make sure NTLM rolling is on. It can really streamline things.
Reply to this answer
You really need to assess what requirements you were aiming to meet with CyberArk. Are those still applicable? It might be worth exploring what kind of overhead you could manage using native AD capabilities. Each environment is different.
Reply to this answer
If you're looking for a solid alternative, check out Devolutions. We had similar frustrations with CyberArk making things cumbersome, so we made the switch to them and it's been a much smoother experience.
Reply to this answer
It's really a balancing act between security and convenience. We had a similar setup with admin accounts before adopting PAM, but due to our industry standards, keeping 24/7 admin rights isn't viable. We opted for a different tool, Netwrix, which has helped us manage elevated access without constant admin rights. The concept is similar—request rights for a limited time and then automatically time out.
Reply to this answer
We had an incident where CyberArk slowed us down too much. Now, we use separate admin accounts for the sysadmin and network teams, and we're incorporating 2FA for everything to boost security.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions