Enterprise Administration Guide › Planning Your PUPM Implementation › Password Consumers › Types of Password Consumers

Types of Password Consumers

A password consumer is the representation of an application, Windows service, or Windows scheduled task that you run on a PUPM endpoint. Except for software development kit password consumers, all other password consumers get privileged account passwords but do not check out or check in the passwords.

PUPM provides privileged account passwords to the following password consumers on demand:

• Software Development Kit (SDK/CLI)—A software development kit password consumer requests a privileged account password when it is executed by a script on the endpoint.

  Use a software development kit password consumer to replace hard-coded passwords in scripts.

  Note: Unlike other password consumers, software development kit password consumers can check out and check in privileged account passwords.

• Database (ODBC, JDBC, OLEDB, OCI, .NET)—A database password consumer requests a privileged account password when a program that is running on the endpoint connects to a database.

  Use a database password consumer to replace hard-coded passwords in programs that connect to a database.

• Windows Run As—A Windows Run As password consumer requests a password when a user executes the RunAs application to substitute to a privileged account and execute a specific command.

  Use a Windows Run As password consumer to let a user substitute to a privileged account and execute a command without the privileged account password.

Note: You must install CA Access Control on the PUPM endpoint with the PUPM Integration feature enabled to use password consumers that get passwords on demand.

PUPM provides privileged account passwords to the following password consumers on password change:

• Windows Scheduled Task—A Windows Scheduled Task password consumer uses a service account to manage a scheduled task. PUPM forces a password change for the task whenever a password change event occurs in CA Access Control Enterprise Management.

  Use a Windows Scheduled Task password consumer to set password policies and automate password changes for scheduled tasks.

• Windows Service—A Windows Service password consumer uses a service account to run a Windows service. PUPM forces a password change for the service account whenever a password change event occurs in CA Access Control Enterprise Management.

  Use a Windows Service password consumer to set password policies and automate password changes for Windows services. The service must be run by an account for which you can change the password, for example, your computer's Administrator account or a domain account.

Note: You do not need to install CA Access Control on the PUPM endpoint to use password consumers that get passwords on password change.

More information:

Create a Password Consumer