Platform Management and CPM Configuration
What this domain tests
Platforms are policy templates; this domain tests how CPM policy, password policy, and platform association combine to produce a change or a failure. Questions typically give a CPM error and ask which layer to change.
Core rules
- A platform bundles password policy (length, complexity, history), automatic password management (change interval, verify interval, retries, immediate change), UI and workflow settings, session/connection components, and reconciliation behavior.
- Built-in platforms should be copied for customization; editing a shipped platform affects every account using it, across Safes.
- Platform association is per account, but the Safe can influence which CPM server and CPM user perform the work. A change can fail because the Safe's CPM assignment cannot reach the target, not because the platform is wrong.
- Immediate change or first-use change rotates on the next CPM cycle after onboarding; interval-based change waits for the schedule.
- Retries are a safety net, not a fix. Repeated retries against a locked or unreachable target deepen a lockout.
- The platform's password policy must be at least as strict as the target's own policy; if CPM generates a shorter or simpler password, the target rejects it.
Worked example
CPM reports 'change failed - password does not meet complexity requirements' for one platform. Reasoning: the target domain requires 14 characters and complexity, but the platform's password policy generates 12-character passwords. The CPM user, network path, and Safe are fine. Fix the platform's password policy (on a copy, if it is built-in), then run a manual change. Setting the password by hand on the account would only postpone the next failure.
Traps that cost marks
- Editing a built-in platform instead of a copy, silently changing behavior for unrelated Safes.
- Assuming 'Verify' failures mean the password is wrong; verification can fail because the CPM user lacks logon rights or the plugin is mismatched.
- Forgetting that a stopped CPM service produces no changes at all, regardless of policy.
- Setting an aggressive interval with retries and then blaming the target for lockouts.