This topic introduces the Account administrator, who creates sets, users, and roles, and also configures the account.
The EPM Management Console is only supported on Windows machines.
The EPM Management Console is supported on the following browsers:
Microsoft Edge Chromium
In Tools > Internet options > Security > Custom level, enable the following options:
Run ActiveX controls and plug-ins
Script ActiveX controls marked safe for scripting
In a browser, enter the EPM URL, then specify your user name and password and click Log in.
Account administrator only
The EPM Management Console appears.
Account administrator and set administrator
The Management Options screen appears.
Select the set to manage or click Administration to open the Server Configuration console.
Click Management Options to return to the Management Options screen.
A set can be defined as a logical container for computers and policies. Each set is self-contained, so settings in a specific set affect that set only. For example, you could create two sets, one for US and one for EU to allow local set administrators to modify a policy without affecting the other region. To manage computers, a new set must be created.
There are two types of sets: regular and non-persistent VDI.
Non-persistent VDI sets
These sets are appropriate for working with endpoints that are constantly being created and erased. Major features of non-persistent VDI sets are:
- Only network and operating system data are reported from each endpoint. This data is not updated, since it becomes irrelevant once the endpoint is erased.
- The Application Catalog, hardware inventory reports, and any computer specific settings are not available.
- Only connected Agents are counted for licensing purposes.
- In the Create Policy wizard you cannot define a Policy with a specific Computer name.
- There are no manual Computer group options.
- There is an indicator near Set Name that this is a non-persistent VDI Set.
- NP_VDI is shown as the Computer name in reports.
- Graphs that reference specific machines are removed from the Reports > Dashboard page.
Create a set
In the EPM Management Console, select Administration > Account Management.
From the Create drop-down menu, select Create Set.
Enter the following information:
The unique name of this set.
The purpose of this set.
The time zone in which this set is relevant.
The type of set defined by the license.
Full protection - This set provides full EPM functionality.
Regular machines - Sets that are created for full protection on regular machines. In Edit mode, the type can be reset to non-persistent VDI machines, but cannot be reset to Credentials rotation.
Non-persistent VDI machines - Sets that are created for non-persistent VDI machines. In Edit mode, the type cannot be changed.
Credentials rotation - This set manages credentials, according to the Credentials Rotation policy. In Edit mode, this type can be reset to full protection.
For more details, see Manage your EPM license.
Manage Set users
In the Account Management page, go to Create > Create User to create an administrator account that will manage the computers and policies in this set.
Specify the following information:
The user's email address, which is the user name.
The user's password.
The scope of the account administrator's access for the set. Options are:
Full control - The user can manage all the set properties.
View only - The user can only view the set and its properties.
Allow to manage Sets
The user can manage every aspect of the set.
Click Next then, for each set, select the role for this user. A single user can manage multiple sets with different roles.
In addition to the predefined Full Control and View Only roles, you can create custom roles. For more information, see Role management.
Change user binding settings
After you have set the initial binding settings between users and sets, you can change them as you need.
In the Account Management page, select the user and the set.
Right-click and select Bind, Change binding for User/Set.
Reset the role for the relevant set, then click OK.
The number of administrators for a set can vary and can be changed at any given time.
Edit a set
In the EPM Management Console, select Administration > Account Management.
Select the set to edit then, from the Edit drop-down menu, select Edit Set <set name>.
For more details about editing sets, see Create a set.
When a set administrator is assigned to manage a specific set, a specific role management function can be bound to an admin account. For example, certain admin accounts can be assigned the default "Full Control Set Admin" Role. If users only require read privileges, the default "View Only Set Admin Role" can be allocated.
You can also create custom roles that fit your specific requirements. For example, a "Help Desk" Role can have permissions to manage policies such as activate and export, but not have rights to delete or create new policies. Role management options are flexible on all levels of the EPM Management Console, and can address many different scenarios.
From the EPM Management Console, select Role Management.
The 'New UI' capabilities are relevant to the new UI that is being released gradually.
Select Role à Create New Role to create a customized role. In the capabilities for the specific role, select permissions associated with the role.
In Account Management, open the list of Set Administrators.
Select a Set Administrator associated with a specific set, right-click and select Change binding of User "<name">.
In the Roles column, select a specific role to assign to the Set Administrator.
You can configure the account settings for all EPM users, including their password and session security settings.
Configure account settings
In the EPM Management Console, select Account Configuration.
Under Password Configuration, set the following parameters for password security:
The minimum number of characters the password must contain. The default value is 12
Letter Case Requirement
Set to On to require both uppercase and lowercase letters in the password.
Set to On to require numbers in the password.
Special Character Requirement
Set to On to require at least one non-alphanumeric character in the password.
Number of Incorrect Password Attempts
The number of consecutive incorrect attempts to enter the password before the user is locked. The default value is 5.
Enable Password Expiration
Set to On to require that the password be changed at a set interval.
Password Expiration Period
If Enable Password Expiration is set to On, the number of days after the password is set until it must be changed. The default value is 90.
Number of Incorrect Security Question Attempts
The number of consecutive incorrect attempts to answer the security question before the user is locked. The default value is 3.
Lockout Time (Minutes)
The number of minutes the user is locked. The default value is 5.
Under Session Expiration, set the following parameters for session security:
Timeout for inactive session (minutes)
The number of minutes before disconnecting an inactive session. The default value is 30.
CyberArk EPM plugin
Several EPM actions require that the CyberArk EPM plugin must be installed. If you have not installed it, when you perform one of these actions you will be prompted to install it.
The CyberArk EPM plugin is only supported on Windows machines.
Download the CyberArk EPM Plugin
Download the CyberArk EPM plugin in either of the following ways:
From the link in the prompt message, download the CyberArkEPMplugin.msi file.
From the Download Center:
In the EPM Management Console, go to My Computers > Download Center and display the Tools tab.
Under Offline authorization, download the Web browser plugin and save it locally.
Installation on Google Chrome and Microsoft Internet Explorer
Double click the file to open the installation wizard, and follow the instructions.
Enter the URL of the EPM Management Console.
In Chrome, click Enable extension on the displayed message to enable the Chrome extension of the CyberArk EPM Plugin to be installed. After installation, the CyberArk icon will appear in the Extensions section.
Continue the wizard until the CyberArk EPM Plugin is installed.
In Chrome, open the On Startup section and verify that Chrome is not in Continue where you left off mode.
Restart the browser.
Installation on Microsoft Edge Chromium
Install the plugin via the EPM console from Google Chrome or Edge Chromium.
In Edge Chromium, open the link to the extension in the webstore, then click Add to Chrome.
In the confirmation prompt, click Add extension.