Symantec Privileged Access Manager Reviews

With the customers that I have so far, I help them broker RDP sessions to sensitive servers, particularly those that manage aspects like physical access. I have also done it for backend databases, domain controllers, and direct access to applications like SQL Server. Instead of having to inject credentials, users can click on a link, which sends them in directly, allowing them to view and manage their database. I also support SSH sessions, and I offer app control that allows applications to request credentials from PAM when they run, thus using PAM almost as a vault for some applications.

The credential injection feature is highly valued, particularly for RDP sessions. A majority of customers use it for RDP, and a couple for Linux servers. The broader capabilities, including access to multiple systems, web-based applications, and clustering, have never posed an issue. The threat analytics aspect is also a robust feature that analyzes all pertinent information.

I work for a service provider company, and we implement Symantec Privileged Access Manager solutions for our clients, which include various banking and mining clients.

We have implemented both the remote access and credential management features. The agent-based credential management solution allows clients to programmatically use the agent to collect passwords during runtime from Symantec Privileged Access Manager. The password management solution and password rotation policy using third-party certificates are easy to implement.

Transparent login for users of privileged IDs (Linux, Windows). This prevents sharing of the password because it is never seen.

Once we implemented the solution, we found that support groups were sharing the Root password with some application teams to facilitate implementations and upgrades. The applications required Root due to software requirements or other issues. This process was never documented and therefore was unknown. We are now working on getting these applications under proper controls. They will either need to use PAM if Root is still required or proper access will be implemented where Root will not be required for day to day support.

We are using Symantec PAM to manage privileged accounts across servers, devices, networks, and applications. It is crucial for managing admin users and controlling privileged accounts. We have also integrated it with CA strong authentication for enhanced security.

Using Symantec PAM makes it easier to deploy rather than BeyondTrust or other competitors. It is easy to implement and stable, which helps us manage deployments successfully over large numbers of servers and devices.

We are using this solution to give access to the infrastructure environment to IT people and consultants. Access to the servers is only through PAM. One of the reasons to use a PAM is to manage Linux and Windows passwords, so it takes care of those accounts.

As global admins, there are six people working on this solution, but I'm the only person managing it as an admin.

It's currently on-prem.

It's easy to use and easy to configure. Compared to BeyondTrust, it's a little complicated.

I have been in the security business for almost 30 years. We have never had a solution in place where we could really manage and control privileged accounts in the company. This solution really makes a big difference. We started rolling it out for our Linux base. It has been invaluable to us already, and it has only been a year.

We are a multiplatform shop, so we have Windows, Linux, mainframe. The mainframe piece of it is coming along, but we would like to see a little bit more integration with the non-CA mainframe component, such as RACF. That is what we use, but they have more features which are coming out in the next month or so, which is a huge. They are listening to their customers. I think that is great, but they need to do a little bit more on the mainframe side.

It is for all admins. We need to have a two-factor authentication. So for that, we are using the PAM, Privileged Access Manager product called Xceedium.

We have just put it in QA, so it will go live in production by March or April. 

It will provide us with more security. Anybody who has access can only get it. It makes admin access more critical. People are not building service accounts. 

It will provide more security and monitoring. 

I mostly do support for the product so I’m aware of all the features this product offers. I like the fact that passwords are checked-in automatically. In case you forget to release the account so that other people can use it, it keeps the account secured by changing the password automatically.

You can do A2A integration. You can have your own script, which can then run outside of PA to retrieve the password and perform other tasks.

It has CLI commands for bulk changes. I’ve used that feature to on-board thousands of accounts, and it saved time and effort rather than doing it manually.

PA is a global vault application which is essential in our day-to-day tasks is retrieving and using privileged accounts. Also provides a nice logging and notification to management as well as audit.