CyberArk: SSMS20 launch using CyberArk PAM 14.4

 Connect SQL Server Management Studio to CyberArk PSM with Database Authentication

CyberArk Privileged Session Manager (PSM) provides secure and monitored access to sensitive systems, including Microsoft SQL Server. This article walks you through the complete step-by-step setup to enable SQL Server Management Studio (SSMS) connections to SQL databases via CyberArk PSM, using local database authentication.

---

What You'll Achieve

You’ll configure:

• SSMS as a PSM connection client

• AppLocker policies to permit SSMS

• PVWA connection component with proper parameters

• Account and security settings for database access

---

 Prerequisites

Before you begin:

• PSM must be installed and operational

• CyberArk PVWA is accessible

• SSMS installer is downloaded from Microsoft

• Local database account with permissions is created

---

Step-by-Step Configuration

 Step 1: Import SQL Server Connection Component

1. Go to the CyberArk Marketplace.

2. Download the connection component:
   SQL Server Management Studio with Database Authentication.

3. Copy files from:

   java
   
   C:\Program Files (x86)\CyberArk\PSM\Components\Connectors\PSM-SSMSConnetor
   

   To:

   java
   
   C:\Program Files (x86)\CyberArk\PSM\Components
   

---

Step 2: Install SSMS on the PSM Server

1. Download SQL Server Management Studio (SSMS) from the Microsoft website.

2. Install it at:

   pgsql
   
   C:\Program Files (x86)\Microsoft SQL Server Management Studio 20\Common7\IDE\Ssms.exe
   

---

 Step 3: Configure AppLocker for SSMS

1. Navigate to the PSM Hardening folder:

   java
   
   C:\Program Files (x86)\CyberArk\PSM\Hardening
   

2. Remove read-only attribute from PSMConfigureAppLocker.xml.

3. Edit PSMConfigureAppLocker.xml:

   xml
   
   <Application Name="SSMS20" Type="Exe" Path="C:\Program Files (x86)\Microsoft SQL Server Management Studio 20\Common7\IDE\Ssms.exe" Method="Publisher" />
   

4. Save and close the file.

5. Apply AppLocker policy:

   powershell
   
   CD "C:\Program Files (x86)\CyberArk\PSM\Hardening"
   ./PSMConfigureAppLocker.ps1
   

---

Step 4: Configure Account Settings in PVWA

While onboarding the target database account, define:

Parameter	Value
Username	Local database user (e.g., sa)
Address	Hostname/IP or FQDN of the SQL server

---

Step 5: Configure Connection Component Settings

In PVWA → Connection Components, configure:

🔸 Target Settings

Parameter	Description	Default
ClientInstallationPath	Path to ssms.exe	C:\Program Files (x86)\Microsoft SQL Server Management Studio 20\Common7\IDE\Ssms.exe
WindowLoadTimeout	Time to load Connect window (in sec)	500
CmdLineParmsHideTimeout	Cmd parameter hide delay (ms)	20000
ClientErrorTimeout	Wait time for error (sec)	30
ApplicationStartTimeout	App launch timeout (ms)	500000
Timeout	Wait for app window (ms)	8000
SSMSErrorMessageDisplayDuration	Display error pop-up duration (ms)	30000
MainWindowTitle	(Optional) App main window title	-
MainWindowClass	(Optional) App main window class	-

🔸 Encryption Settings

Parameter	Description	Default
Encryption	Enforce encrypted connection	Mandatory
TrustServerCert	Trust self-signed SQL cert	No
HostNameInCertificate	SQL server hostname (required if TrustServerCert = No)	FQDN

🔸 Optional

Parameter	Purpose
AllowMappingLocalDrives	Allow drive mapping during session

Happy Learning !!