Implements Delinea Secret Server for privileged access management (PAM) including secret vault configuration, role-based access policies, automated password rotation, session recording, and integration with Active Directory and cloud platforms. Activates for requests involving PAM deployment, privileged credential vaulting, secret server administration, or password rotation automation.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Implements Delinea Secret Server for privileged access management (PAM) including secret vault configuration, role-based access policies, automated password rotation, session recording, and integration with Active Directory and cloud platforms. Activates for requests involving PAM deployment, privileged credential vaulting, secret server administration, or password rotation automation.
Service accounts and shared credentials are stored in spreadsheets or plaintext files
Need to implement automated password rotation for privileged accounts
Require session recording and keystroke logging for privileged user activity
Migrating from manual PAM processes to an enterprise vault solution
Do not use for standard end-user password management; Delinea Secret Server is designed for privileged and shared account credential management requiring enterprise-grade controls.
Common Misconfigurations & Verification
These silently neuter the vault even when the dashboard shows "green":
Checkout-bypass via still-valid direct creds: secret is vaulted but the password was never rotated after import, so the original known value still authenticates directly to the target, bypassing checkout/approval entirely. Force a one-time RPC change on import, then confirm the old value fails: Invoke-RestMethod "$baseUrl/api/v1/secrets/100/remote-password-changing" -Method GET -Headers $headers and check lastPasswordChangeAttempt is recent and autoChangeEnabled = true.
RPC configured but no Distributed Engine reachable to the network segment: rotation queues and silently fails behind firewalls. Query "$baseUrl/api/v1/distributed-engine/status" and reconcile against "$baseUrl/api/v1/secrets/{id}/rpc/status" for Failed/Pending states.
Heartbeat disabled masks stale/out-of-band-changed creds. Verify heartbeatStatus = Success per secret, not just policy existence.
Session launcher not enforced: users still RDP/SSH directly with vaulted creds, so no recording occurs. Confirm "Proxy Enabled"/"Require launcher" on the secret policy and check SecretView events correlate with SessionStart events in the audit log; views with no matching session indicate direct credential use.
Dual control / Require Approval applied to only some Tier-0 folders: enumerate folder permissions ("$baseUrl/api/v1/folders/{id}/permissions") and confirm every Domain Admin / root folder has requireApproval = true.
Break-glass account not monitored: confirm a Syslog/SIEM alert exists for any on the emergency secret and that it is excluded from auto-rotation lockout.
SecretView
Prerequisites
Delinea Secret Server license (On-Premises or Cloud)
Windows Server 2019/2022 for on-premises deployment with IIS and SQL Server
Active Directory service account with read permissions for discovery
SSL/TLS certificate for web interface encryption
Network connectivity to target systems for password rotation
PowerShell 5.1+ for automation scripts
Workflow
Step 1: Deploy Secret Server Infrastructure
Install and configure the Secret Server application server:
# Pre-installation checks for on-premises deployment
# Verify IIS is installed with required features
Import-Module ServerManager
Install-WindowsFeature Web-Server, Web-Asp-Net45, Web-Windows-Auth, Web-Mgmt-Console
# Verify SQL Server connectivity
$sqlConn = New-Object System.Data.SqlClient.SqlConnection
$sqlConn.ConnectionString = "Server=sql01.corp.local;Database=master;Integrated Security=True"
$sqlConn.Open()
Write-Host "SQL Server connection successful: $($sqlConn.ServerVersion)"
$sqlConn.Close()
# Create Secret Server database
Invoke-Sqlcmd -ServerInstance "sql01.corp.local" -Query @"
CREATE DATABASE SecretServer
GO
ALTER DATABASE SecretServer SET RECOVERY FULL
GO
"@
# Download and run Secret Server installer
# Navigate to https://thy.center/ss/link/SSDownload for latest version
# Run setup.exe and follow the installation wizard
# Post-installation: Configure application pool
Import-Module WebAdministration
Set-ItemProperty "IIS:\AppPools\SecretServer" -Name processModel.identityType -Value SpecificUser
Set-ItemProperty "IIS:\AppPools\SecretServer" -Name processModel.userName -Value "CORP\svc-secretserver"
Step 2: Configure Secret Templates and Folder Structure
Define secret templates and organize the vault hierarchy:
Security framework for controlling, monitoring, and auditing elevated access to critical systems and data through credential vaulting and session management
Secret
A stored credential or sensitive data item in the vault, including passwords, SSH keys, API tokens, and certificates
Remote Password Changing (RPC)
Automated mechanism that connects to target systems to rotate passwords according to defined policies without manual intervention
Heartbeat
Periodic check that validates stored credentials against target systems to ensure vault contents remain synchronized and functional
Dual Control
Security mechanism requiring approval from a second authorized user before granting access to highly sensitive secrets
Discovery
Automated scanning of infrastructure to identify privileged accounts, service accounts, and dependencies across Active Directory, servers, and network devices
Session Recording
Capture of complete privileged session activity including video, keystrokes, and application usage for audit and forensic review
Delinea Distributed Engine: Agent deployed in network segments to enable password changing and discovery across firewalled environments
Secret Server REST API: RESTful API for programmatic secret management, automation, and integration with DevOps pipelines
Secret Server SDK: .NET and PowerShell SDKs for application-level integration with Secret Server vault
Common Scenarios
Scenario: Migrating Shared Admin Credentials to Vault
Context: An organization stores 500+ shared administrator credentials in Excel spreadsheets and password-protected documents. Auditors flagged this as a critical finding requiring remediation within 90 days.
Approach:
Deploy Secret Server with SQL Server backend and configure HTTPS access
Design folder hierarchy mirroring the organizational structure (by department, system type, environment)
Create secret templates matching the credential types in use (Windows, Linux, database, network device)
Import existing credentials via CSV import or PowerShell bulk creation
Configure discovery to find undocumented privileged accounts across AD and local systems
Enable Remote Password Changing starting with non-production accounts to validate rotation
Roll out session launchers to replace direct RDP/SSH connections
Gradually enable dual control for Tier-0 accounts (Domain Admins, root accounts)
Configure SIEM integration and compliance reporting for audit evidence
Pitfalls:
Not identifying all service account dependencies before enabling password rotation (causes service outages)
Enabling RPC for production accounts without testing in non-production first
Setting rotation intervals too short for service accounts that require coordinated restarts
Not configuring Distributed Engines for network segments separated by firewalls
Output Format
DELINEA SECRET SERVER PAM DEPLOYMENT REPORT
=============================================
Environment: Hybrid (On-Premises + Azure)
Version: Secret Server 11.6
Deployment Mode: On-Premises (High Availability)
VAULT STATISTICS
Total Secrets: 1,247
Windows Credentials: 523
Linux/SSH Keys: 312
Database Accounts: 198
Network Devices: 87
Cloud API Keys: 127
PASSWORD ROTATION STATUS
Auto-Change Enabled: 1,089 / 1,247 (87.3%)
Rotation Compliant: 1,056 / 1,089 (97.0%)
Heartbeat Healthy: 1,198 / 1,247 (96.1%)
Failed Rotations (30d): 12
SESSION MANAGEMENT
Active Sessions: 23
Recorded Sessions (30d): 4,567
Average Session Length: 22 minutes
Approval Requests (30d): 189 (174 approved, 15 denied)
DISCOVERY RESULTS
Scanned Systems: 2,340
Discovered Accounts: 3,891
Onboarded to Vault: 1,247 (32.1%)
Pending Review: 892
COMPLIANCE
SOX Controls Met: 12/12
PCI-DSS Requirements: 8/8
Password Age Violations: 3 (remediation in progress)
