CyberArk PSM Connect Fail: After Auth When the Jump Never Starts

CyberArk · Techclick CLI troubleshooting lab

User authenticates to PVWA. PSM session never starts. The target server is up. Vault is healthy.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on CyberArk for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

PSM is a jump. Check the PSM server service, the connector account, and RDP/SSH from PSM to the target — not the user's laptop to the target.

Why this ticket shows up

A healthy Vault does not prove the PSM host can reach the server with the reconciled account.

Symptoms operators actually see

• PVWA OK, black PSM window

• PSM service stopped

• Hardening blocks RDP from PSM

• Account not reconciled

CLI first — copy this block

Run these on the CyberArk device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

Get-Service *PSM* | Format-Table -Auto
Test-NetConnection 10.20.20.20 -Port 3389
whoami
Get-EventLog -LogName Application -Newest 30 | Where-Object {$_.Source -match 'CyberArk|PSM'}
nltest /sc_query:corp.local

How to read that output

If PSM cannot TCP 3389/22 to the target, the user will never land. Fix PSM-to-target, not user-to-target.

Triage order

1. Check PSM services

2. From PSM, test the target port

3. Confirm the connect account is reconciled

4. Read PSM event log

5. Only then look at PVWA policy

Classic traps

What you see	Real cause	Fix
Open 3389 to the user	Design is jump through PSM	Do not bypass
Restart Vault	PSM host is the fail	Wrong box
Give the user the local admin	That defeats PAM	Fix PSM

Proof the ticket is closed

• PSM session opens

• Target logon uses the managed account

• User laptop still has no direct 3389

Say this in an interview

PSM failures are jump-host problems. I test from the PSM server to the target.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/