This post is to summarize a way how to configure a remote connection manager tool to integrate with CyberArk PSM. In this way, you can directly RDP into target server through PSM, without logging into PVWA to do connect.

Related Post:

Microsoft Remote Desktop Connection (MSTSC)

To use Microsoft standard RDP client, Microsoft Remote Desktop Connection (MSTSC), you will need to start a program with following command
psm /u {Priv_Account_Name} /a {Server_Name} /c PSM-RDP
For example: psm/u [email protected] /a /c PSM-RDP

Windows 10 machines, Remote Desktop Connection might not have Program tab. Add the following line to the .rdp file: alternate shell:s:psm /u target-user /a target-address /c connection-component


MSTSC has NLA enabled by default and the RDP connection will prompt a Windows Security window for authentication. To disable NLA when connecting with MSTSC, add the setting enablecredsspsupport:i:0 to one of the following files by editing the rdp file with notepad

Microsoft Remote Desktop Connection Manager

Microsoft has retired MRDCM software and following link is not having download anymore. There is some serious vulnerabilities found in this software, although it is still very popular Remote Desktop Connection Manager tool.
You can
download RDCM here:

Search by google and found this link to download :
To integrate RDCM with CyberArk PSM, it requires some configuration changes on RDP file object. This post lists least step you will need to follow to get RDCM working with PSM. 

1      In RDP Connection Manager, highlight your RDP
File object and select Add Server…
2       Configure the Server Settings tab:
Populate the Server name field with the text {PSM-Server-Hostname}
Enter a friendly name of your
choice in the Display name field.
3        Configure the Connection Settings tab:
Uncheck the Inherit from parent checkbox.
Populate the Start program field with this string as
shown in the sample screenshot below:
psm /u {Priv_Account_Name}@51Sec-ITPROSEC /a {Server_Name}
            {Priv_Account_Name} = The username
of the privileged account as defined in CyberArk; ie. MyUsernameAdmin
            {Server_Name} = The shortname of
the server name as resolvable via DNS; ie. 

1   4   Configure the Logon Credentials tab as
shown in the sample screenshot below:
Uncheck the Inherit from parent checkbox
Enter your non-privileged AD account
username in the User name field
Enter the text 51Sec-ITPROSEC in the Domain

When you click to connect, you will enter the
password for your non-privileged AD account.

Notes: How to connect to RDP Console / admin mode:
If you choose connect to console / admin, PSM will deny the session.

PSM server will tell you “The requested session access is denied”.
  • Make a copy of the PSM-RDP connection component (lets call it PSM-RDP-ADMIN).
  • Set the “AlloweConnectToConsole” Value=Yes, Visible=Yes.
  • Add it to the desired platform
  • In RDP client where you specify the psm /u etc.. commands, change the /c to PSM-RDP-ADMIN
There is no “admin connect” in current version of MS-Windows after server 2003:
For 2003 or Windows XP you would need a custom connection component with mstc.exe /admin or mstc.exe /console as the command.


MobaXterm also support PSM well. Here are all configuration steps in the screenshot. 

Most important step is to configure Remote command “psm /u [email protected] /a /c PSM-RDP

Create a domain user account and save it into credential list. 


So far, not find a good way to support remote command to launch “psm /u [email protected] /a /c PSM-RDP” after RDP logged in PSM .

Remote Desktop Manager Free Edition

YouTube Video:👀


By Jon

Leave a Reply

%d bloggers like this: