This document provides instructions and code samples for automating common CyberArk password vault tasks using PowerShell, including onboarding accounts, retrieving credentials, managing sessions, and creating a safe with role-based access groups. It demonstrates how to connect to the CyberArk PAS API, create a new safe, generate Active Directory security groups for admin, auditor and user roles, assign permissions to the groups, and add them as members to the safe. The script handles validation and skips steps if objects already exist, and provides examples of credential retrieval from vault using different SDKs.

1. 1
🌎 🌍

2. •
•
•
•
•
•
•
•
•
•
•
•
•
•
🕐
2

3. •
•
•
•
•
•
•
•
•
•
•
•
🕑
3

4. •
•
•
•
•
🕒
5

5. 6

6. •
•
•
•
•
•
•
•
•
•
7

7. 8

8. •
•
•
•
•
9

9. 10
🏃 🏻♂️

10. 11
•
•
•
•

11. 12
•
•
•
•
•
•
•
•
•
•
•
•
Accounts_Onboard_Utility.ps1 –PVWAURL https://pvwa.domain.com/PasswordVault -Create –AuthType ldap
–TemplateSafe WinLocalTemplate –CsvPath “${env:userprofile}Documentscyberark-import.csv”

12. 13
Accounts_Onboard_Utility.ps1 –PVWAURL https://pvwa.domain.com/PasswordVault -Update –AuthType ldap
–TemplateSafe WinLocalTemplate –CsvPath “${env:userprofile}Documentscyberark-import.csv”
•
•
•
🏃 🏻♂️

13. 14
🏃 🏻♂️

14. 15
•
•
•
•
🏃 🏻♂️

15. •
•
•
•
•
•
•
•
16

16. •
•
•
•
•
17

17. 18
•
•
•
•
•
•
•
•
•
•
•

18. 19
•
•
• Install-Module
•
•
•
• Import-Module
•
•
•

19. 20
Get-CCPCredential –AppID DemoApp –Safe DemoSafe –UserName DemoUser –URL
https://components.cyberarkdemo.com
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

20. 21
Import-Module CredentialRetriever
do {
$response = Get-CCPCredential –AppID DemoApp –Safe DemoSafe –UserName
DemoUser –URL https://components.cyberarkdemo.com
} until ( $response.PasswordChangeinProcess –eq $false )
Write-Output $response.Content # Password
Write-Output $response.UserName # Username
Write-Output $response.Address # Address
🏃 🏻♂️

21. 22
Set-AIMConfiguration –ClientPath “C:Program Files
(x86)CyberArkApplicationPasswordSdkCLIPasswordSDK.exe”
•
•
•

22. 23
Get-AIMCredential –AppID DemoApp –Safe DemoSafe –UserName DemoUser -RequiredProps Address,Username
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

23. 24
Import-Module CredentialRetriever
Set-AIMConfiguration –ClientPath “C:Program Files
(x86)CyberArkApplicationPasswordSdkCLIPasswordSDK.exe”
do {
$response = Get-AIMCredential –AppID DemoApp –Safe DemoSafe –UserName
DemoUser –RequiredProps Address,Username
} until ( $response.PasswordChangeinProcess –eq $false )
Write-Output $response.Content # Password
Write-Output $response.UserName # Username
Write-Output $response.Address # Address
🏃 🏻♂️

24. 28

25. •
•
•
•
•
•
•
•
•
29

26. •
•
•
•
•
•
•
•
30

27. 31

28. 32

29. 33
Import-Module psPAS
# Since token is stored in the session, no need to save
# the response in a variable for use later.
New-PASSession -BaseURI https://components.cyberarkdemo.com -Type ldap -
Credential $(Get-Credential)
Close-PASSession

30. 34
Import-Module psPAS
# Since token is stored in the session, no need to save
# the response in a variable for use later.
New-PASSession -BaseURI https://components.cyberarkdemo.com -Type radius -
Credentials $(Get-Credentials)
Close-PASSession

31. 35
Import-Module psPAS
# Since token is stored in the session, no need to save
# the response in a variable for use later.
New-PASSession -BaseURI https://components.cyberarkdemo.com -Type radius -
Credentials $(Get-Credentials) -OTPMode Append -OTP 123456
Close-PASSession

32. 36
Import-Module psPAS
# Since token is stored in the session, no need to save
# the response in a variable for use later.
New-PASSession -BaseURI https://components.cyberarkdemo.com -Type radius -
Credentials $(Get-Credentials) -OTPMode Challenge -OTP 123456
Close-PASSession

33. 37

34. 38
Get-PASSafe –query D-Nix | Get-PASSafeMember | Where-Object { $_.Permissions –contains ‘Add’ }
•
•
•
•
•
•
🏃 🏻♂️

35. 39
Import-Module psPAS
$secGrp = "CyberArk_Vault_Admins"
# Get all safes and pass to ForEach loop...
Get-PASSafe | ForEach-Object {
# Get all safe members from each safe and return those that do not have
# CyberArk_Vault_Admins security group as a member.
if ($(Get-PASSafeMember -SafeName $_.SafeName) -notcontains $secGrp) {
Write-Output $_.SafeName
}
}

36. 40

37. 41
Import-Module ActiveDirectory
function New-CyberArkADGroups ($safeName) {
$roles = "Admins", "Auditors", "Users"
foreach ($role in $roles) {
$groupName = "CyberArk_${safeName}_${role}"
if (!$(Get-ADGroup $groupName –ErrorAction SilentlyContinue)) {
New-ADGroup -Name $groupName -DisplayName $groupName `
-SamAccountName $groupName -GroupCategory Security `
-GroupScope Global `
-Path "OU=Groups,OU=CyberArk,DC=workshop,DC=local" `
| Out-Null
Write-Output "Created $groupName successfully."
}
else {
Write-Output "Skipped $groupName. Already exists."
}
}
}

38. 42

39. •
•
•
•
•
•
43

40. 44

41. 45
Import-Module CredentialRetriever
Import-Module psPAS
Import-Module ActiveDirectory

42. 46
Import-Module CredentialRetriever
Import-Module psPAS
Import-Module ActiveDirectory
# Script Variables
$Global:roles = "Admins", "Auditors", "Users"
$safePermsAdmins = @{}
$safePermsAuditors = @{}
$safePermsUsers = @{}

43. 47
Import-Module CredentialRetriever
Import-Module psPAS
Import-Module ActiveDirectory
# Script Variables
$Global:roles = "Admins", "Auditors", "Users"
$safePermsAdmins = @{}
$safePermsAuditors = @{}
$safePermsUsers = @{}
# Get User Input
# # (This could also come in from a CSV file using Import-Csv)
Write-Output "Welcome to Company X Safe Factory v1.0"
do {
$safeName = Read-Host "Enter the safe name to create (28 char limit)"
} until ($safeName.length -le 28)
$safeDesc = Read-Host "Enter the description for the safe"

44. 48
function New-CyberArkADGroups ($safeName) {
foreach ($role in $roles) {
$groupName = "CyberArk_${safeName}_${role}"
if (!$(Get-ADGroup $groupName –ErrorAction SilentlyContinue)) {
New-ADGroup -Name $groupName -DisplayName $groupName `
-SamAccountName $groupName -GroupCategory Security `
-GroupScope Global `
-Path "OU=Groups,OU=CyberArk,DC=workshop,DC=local" `
| Out-Null
Write-Output "Created $groupName successfully."
}
else {
Write-Output "Skipped $groupName. Already exists."
}
}
}

45. 49
# Main
# # Securely login to PAS REST API while fetching credentials from AAM
try {
New-PASSession -BaseURI https://components.workshop.local `
-Credential $( `
Get-CCPCredential -AppID RESTAPIWorkshop -Safe P-APP-CyberArk-API `
-UserName Svc_CyberArkAPI -URL `
https://components.workshop.local `
).ToCredential() `
-type LDAP
} catch {
Write-Error -Message "Unable to connect to PAS Web Services." -Category
ConnectionError
exit(1)
}

46. 50
# # Create the safe and continue on if it already exists...
Add-PASSafe -SafeName $safeName -Description $safeDesc -ManagingCPM
PasswordManager -NumberOfVersionsRetention 5 -ErrorAction SilentlyContinue
# # If the safe exists, an error occurs silently and we just continue

47. 51
# # Create the safe and continue on if it already exists...
Add-PASSafe -SafeName $safeName -Description $safeDesc -ManagingCPM
PasswordManager -NumberOfVersionsRetention 5 -ErrorAction SilentlyContinue
# # If the safe exists, an error occurs silently and we just continue
# # Create the Active Directory security groups
# # to be used as Safe Members on the Safe
New-CyberArkADGroups $safeName

48. 52
# # Create permission sets for role-based Safe Members
# # We're using a technique called a "SPLAT"
$safePermsAdmins = @{
ListAccounts = $true
AddAccounts = $true
UpdateAccountContent = $true
UpdateAccountProperties = $true
InitiateCPMAccountManagementOperations = $true
RenameAccounts = $true
DeleteAccounts = $true
UnlockAccounts = $true
ManageSafe = $true
ManageSafeMembers = $true
BackupSafe = $true
AccessWithoutConfirmation = $true
CreateFolders = $true
DeleteFolders = $true
MoveAccountsAndFolders = $true
}

49. 53
$safePermsAuditors = @{
ListAccounts = $true
ViewAuditLog = $true
ViewSafeMembers = $true
}
$safePermsUsers = @{
UseAccounts = $true
RetrieveAccounts = $true
ListAccounts = $true
AddAccounts = $true
UpdateAccountContent = $true
UpdateAccountProperties = $true
InitiateCPMAccountManagementOperations = $true
UnlockAccounts = $true
ViewAuditLog = $true
ViewSafeMembers = $true
}

50. 54
# # Add created Security Groups as Safe Members to our newly created Safe
Add-PASSafeMember -SafeName $safeName -MemberName
CyberArk_${safeName}_Admins -SearchIn ”workshop.local" @safePermsAdmins
Add-PASSafeMember -SafeName $safeName –MemberName
CyberArk_${safeName}_Auditors -SearchIn ”workshop.local" @safePermsAuditors
Add-PASSafeMember -SafeName $safeName -MemberName CyberArk_${safeName}_Users
-SearchIn ”workshop.local" @safePermsUsers

51. 55
# # Add created Security Groups as Safe Members to our newly created Safe
Add-PASSafeMember -SafeName $safeName -MemberName
CyberArk_${safeName}_Admins -SearchIn ”workshop.local" @safePermsAdmins
Add-PASSafeMember -SafeName $safeName –MemberName
CyberArk_${safeName}_Auditors -SearchIn ”workshop.local" @safePermsAuditors
Add-PASSafeMember -SafeName $safeName -MemberName CyberArk_${safeName}_Users
-SearchIn ”workshop.local" @safePermsUsers
# # Verify the safe exists with the proper safe members
foreach ($role in $roles) {
$result = Get-PASSafe -Safe $safeName | Get-PASSafeMember | Where-Object {
$_.UserName -eq "CyberArk_${safeName}_${role}" }
if (!$result) {
Write-Error -Message "Could not find CyberArk_${safeName}_${role} as a Safe
Member of ${safeName}.”
exit(1)
}
}

52. 56
# # Logoff PAS REST API Session
Close-PASSession | Out-Null

53. 57

54. 58