PSM Hardening Tasks

1. To check the current PowerShell script execution policy, open the PowerShell window, then run the command Get-ExecutionPolicy.The command will return a RemoteSigned status.

   Get-ExecutionPolicy

2. If the command does not return the RemoteSigned status, run the following command to allow local PowerShell scripts to run

   Set-ExecutionPolicy RemoteSigned –force

For more information about this command, refer to PowerShell's man page.

1. Remove the read-only permissions from the PSM hardening script file PSMHardening.ps1.

2. Open the PSM hardening script using Notepad and proceed with the following options:

3. To enable the PSM to connect to Web applications change the value of $SUPPORT_WEB_APPLICATIONS to $true.

4. To harden a PSM cluster:

   1. In the $PSM_VAULT_FILE_PATH parameter, specify the shared Vault folder and/or the Vault file that is not under the PSM directory path.

   2. In the $PSM_RECORDING_PATH parameter, specify the shared recording folder and/or recording directory that is not under the PSM directory path.

1. In a PowerShell window, open the PSM installation >\Hardening folder.

   CD “C:\Program Files (x86)\CyberArk\PSM\Hardening”

2. To start the script, run the following command:

   ./PSMHardening.ps1

1. Check the log for errors.

2. If the log contains errors, refer to the # Error Codes section in the hardening script for troubleshooting suggestions. If you cannot solve the problem, contact your CyberArk support representative.

3. If the PVWA is installed on the same machine, check that the script recognized and modified the PVWA folders’ permissions.

4. If the script did not recognize the PVWA, or a warning message was written in the log, modify the permissions manually as follows:

5. Return the security level for running PowerShell scripts to the same status as it was before you ran the script. For example, to set the execution policy to Restricted, run the following command:

   Set-ExecutionPolicy restricted

For more information about this command, refer to PowerShell's man page.

1. From Start, run the following executable: gpedit.msc; the Local Group Policy Editor window appears.

2. In Computer Configuration, select Administrative Templates; a list of available templates is displayed.

3. In the list of templates, double-click Windows Components, and then double-click Internet Explorer; a list of settings is displayed.

4. Double-click Toolbars.

5. Double-click Turn off Developer Tools, then in the settings window, select Enabled.

6. Click OK.

1. From Start, run the following executable: regedit.exe; the Registry Editor window appears.

2. Display the contents of the following key:

   HKEY_LOCAL_MACHINE \ SOFTWARE \ Policies \ Microsoft \ Internet Explorer \ Restrictions.

3. Change the value of the DWORD NoBrowserContextMenu to 1. If DWORD does not exist, create it.

1. Make sure that the organizational GPO AppLocker policy is not enabled on the PSM machine.

2. Configure the PSM machine to allow PowerShell scripts to run:

   1. Open a PowerShell window, then run the Get-ExecutionPolicy command to check the current PowerShell script execution policy, as shown in the following example.

   2. The command will return the RemoteSigned status.

      Get-ExecutionPolicy

   3. If the above command does not return the RemoteSigned status, run the Set-ExecutionPolicy command to allow local PowerShell scripts to run, as shown in the following example:

      Set-ExecutionPolicy RemoteSigned –force

For more information about this command, refer to the PowerShell man page.

1. In the PSM installation folder, remove the read-only permissions from the PSMConfigureAppLocker.xml file.

2. Open the PSMConfigureAppLocker.xml configuration file and edit the PSM AppLocker configuration manually.

   1. Make sure that the paths specified in the file specify the PSM installation folder path.

   2. If your environment includes executables that must be allowed, in addition to those that are built-in the PSM installation, such as PSM Universal Connectors executables, add a rule for each executable to allow it on the PSM server.

3. Run the Automatic PSM AppLocker Configuration Script to set the AppLocker and ensure that PSM users can only run approved applications. This script enables PSM users to invoke internal PSM applications and mandatory Windows applications. The PowerShell script that configures the AppLocker Rules is called PSMConfigureAppLocker.ps1. This PSMConfigureAppLocker.ps1 script file is located in the folder PSM installation > Hardening

   • In a PowerShell window, open the PSM installation >\Hardening folder.

     CD “C:\Program Files (x86)\CyberArk\PSM\Hardening”

   • To start the script, run the following command:

     ./PSMConfigureAppLocker.ps1

1. Open the Group Policy Management Console (GPMC.msc) on your domain.

2. Expand Group Policy Management, then the <yourDomain> forest, and then Domains.

3. Expand <yourDomain>, then right-click Group Policy Objects and select New.The New GPO window appears.

4. In the Name field, specify the name of the new GPO (for example, CyberArk PSM Hardening), then click OK.

5. In the Group Policy Objects, right-click the newly created GPO then select Import Settings….

The Import Settings Wizard appears.

6. In the Welcome to the Import Settings Wizard window, click Next. The Backup GPO window appears.

You do not have to configure backup as this GPO is new.

7. Click Next. The Backup location screen appears.

8. Click Browse, and select the location of the folder where the hardening settings are stored. For example, CyberArk PSM Hardening - GPO Settings from the installation package.

9. Then click Next. The Source GPO window appears.

10. Select the Hardening GPO, for example, PSM Hardening GPO, then click Next. The Scanning Backup window appears.

11. Click Next. The Completing the Import Settings Wizard window appears.

12. Click Finish. The Import window appears and shows the progress of the GPO import.

13. When the GPO import process is complete, click OK.

1. Make sure all Servers are located under a dedicated OU, so the GPO will not affect any other server.

2. In the Group Policy Management Console, right-click the OU, then select Link an Existing GPO.

3. Select the relevant GPO, for example, PSM Hardening, then click OK.

1. Copy the relevant INF hardening file to the local machine (CyberArk component).

2. In a command line, run gpedit.msc.

3. Display Computer Configuration, then display Windows Settings.

4. Right-click Security Settings, and Import Policy.

5. Browse to the folder where the INF hardening file is located, for example, CyberArk PSM Hardening, and open it.

1. Copy the relevant Advanced Audit.csv file to the local machine (CyberArk component).

2. In a command line, run gpedit.msc.

3. Display Computer Configuration, then display Windows Settings, and expand Security Settings.

4. Expand Advanced Audit Policy Configuration, then right-click System Audit Policies – Local Group Policy Object, and select Import Settings.

5. Browse to the folder where the Advanced Audit.csv is saved, and open it.

1. At a command line, run gpedit.msc.

1. Display Computer Configuration, then display Windows Settings, and expand Security Settings.

2. Expand Local Policies, then select User Rights Assignment.

3. Add the PSMShadowUsers group to the Allow log on locally list.

4. Add the PSMConnect / PSMAdminConnect users to the Allow log on through Remote Desktop Services list. To ensure that unauthorized users will not gain access to the PSM server, this setting must only be allowed for the PSMConnect and PSMAdminConnect users, and for maintenance users who are required to logon remotely to the PSM server. You will have to redefine this setting after each PSM server upgrade. Make sure that the effective policy, including configurations made at domain level, defines this setting as described above.