Session Management and Privileged Access
Launching without exposing passwords
Session management in Secret Server is about using a vaulted credential without revealing it. The Session Launcher starts RDP, SSH, PuTTY, or command-line sessions using the secret's fields; by default the password is not displayed. Launcher options are configured on the secret/template. Session Recording captures the session (screen and input, depending on protocol/version) for playback and audit. It requires a Session Recording Server role/component, and recordings should be stored and retained according to policy. Session Monitoring lets an authorized person view a live session. These are detective controls: they record and deter, but do not by themselves block a command.
Privileged access controls
The exam expects you to connect session management to least privilege and just-in-time access. A user may need View on the secret and, separately, approval before launch. Approval can be time-bound; after expiry the user must request again. In segmented networks, a Distributed Engine provides the network path for launcher/heartbeat/RPC traffic. Delinea's cloud Privileged Access Service extends PAM controls such as just-in-time access, approval, and session recording; know the concept even if your environment is Secret Server on-prem.
Worked example
An administrator must RDP to a domain controller to fix a service. The secret has an RDP launcher and a policy requiring approval and recording. The admin requests access; an approver grants 45 minutes. The admin launches the session from Secret Server, the password is injected into the RDP client, and the session is recorded. Reasoning: approval enforces just-in-time access; the launcher avoids password disclosure; recording provides evidence; the time limit reduces standing access. If the target is in a remote site, place an engine there so the launch path works.
Traps
- Saying recording prevents a user from running a command; it is detective.
- Assuming the launcher always reveals the password; it normally does not.
- Forgetting the Session Recording Server; recording will not work without it.
- Treating secret View as sufficient when launch approval is also required.
- Ignoring network reachability/engine placement for RDP or SSH.
- Overlooking recording retention and who can play back recordings.