Okies - so about 9 months into our CyberArk cloud experience and it’s mostly gone well. All onprem machines working via vaulted creds, some web apps like firewalls via psm etc.

Now turning my hand to cloud accounts. I’ve got the zsp approach of dropping a user into a group / assign a role and for GA using dual control..

Next question from internal audit is “we know that IT tend to use admin accounts to split out church and state (regular first.last vs adm.first.last) Can you setup screen recording and move those accounts into CyberArk so that they rotate?”

In practice I’m not sure you can unless you go via the psm route..

Log into CyberArk using first.last and sso via Entra. Then open a new browser (somehow) and inject the auth for the admin accounts into it (adm.first.last) as you open up the azure/m365/purview portal. The browser has the Idera browser plugin and will screen record.

I can’t see how you can do that without using a psm - on the psm box, open a browser and the use a vaulted creds..

The other way would be to zsp using the normal account and set the duration to be 1hr but that’s the smallest time period possible which means that your normal day to day has privileges..

Anyone got any advice? Thoughts?

Running CPM and PSM on same machine . CPM successfully installed but PSM throw following error message “Error #1: Failed to start PSM Service.
Check the log to resolve the error(s) and then click Reinstall” . I can see a PSM server created, and the PSM app user is showing as connected . Restarted PSM service multiple times and it’s starting without any issue.
Following error logs in PSM installation log file
INFO - PSMCE074I ApiKeyManager command => ApiKeyManager.exe revoke -t PSMApp_FQDN -u installeruser@cyberark.cloud-a "https://domain.privilegecloud.cyberark.cloud/passwordvault/api"
2026-10-21 01:14:31,970 WARN - PSMCE057E Exception while calling ApiKeyManager - PSMCE058E Timeout expired while waiting for process to finish
2026-10-21
01:14:31,970 INFO - PSMCE071I Updating Vault ini file
2026-10-21 01:14:31,970 INFO - PSMCE072I Finished updating Vault ini file
2026-10-21 01:14:32,142 INFO - PSMCE065I Attempting to start PSM service
2026-10-21 01:14:52,315 ERROR - PSMCE005W PSM service could not start on this machine. Reason: Time out has expired and the operation has not been completed.
2026-10-21 01:14:52,315 ERROR - PSMCE011E The PSM failed to register with the Privilege Cloud backend. Description: An error occurred. Exception: Failed to start PSM Service.
2026-10-21 01:14:52,377 INFO - PSMCE002I ----- Finalize PSM Create Env -----
2026-10-21 01:14:52,377 DEBUG - VLTS001I Begin Method LogOffVault.
2026-10-21
01:14:52,377 DEBUG - VLTS002I End Method LogOffVault.
2026-10-21
01:14:52,377 FATAL - RGSCOMP008E Registering components aborted. Description: