> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/privileged-access-pam-setup/privileged-account-activities.md).

# Privileged account activities

The vault holds the credentials for the privileged accounts SECUREpass manages. Users never see them — the Access Gateway injects the password into the session on their behalf.

This guide covers where accounts are vaulted, how rotation works, and how emergency break-glass access is enabled and used.

## Where accounts are vaulted

Accounts are added to the vault in step 2 of the Add or Edit System wizard, under **Local Accounts**. Each configured account appears as a card showing its type and its rotation policy.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/2cf7FDRHmHfI2Zjpy3om/assets/01.png)

The card above reads **LOCAL · 90d rotation** — a local account on a 90-day rotation cycle, which is the default for local accounts.

## Opening the Account Vault

Once a system is onboarded, its credentials are managed from the **Account Vault** rather than from the wizard. On the **Manage Systems** list, select the padlock icon in the **Actions** column for that system.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/fYOuFqqa4M22vDPenwVo/assets/02.png)

The Account Vault panel opens.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/Hz7ejMy2LGvZn7qPm2S5/assets/03.png)

| Column          | Shows                                                                      |
| --------------- | -------------------------------------------------------------------------- |
| Account Name    | The vaulted account                                                        |
| Type            | **LOCAL** for an account on the system itself, as against a domain account |
| Rotation Policy | How often the password rotates. 90 days by default for local accounts      |
| Last Rotation   | When it last rotated, or **Never**                                         |
| Actions         | View the credential, edit the rotation policy, or rotate now               |

{% hint style="info" %}
The Account Vault manages credentials only. To **add or remove** an account, go back to **Edit System → Step 2 — Local Accounts**, so that roles and authentication types are configured along with it.
{% endhint %}

## Rotation

Rotation replaces a vaulted password with a newly generated one and changes it on the target at the same time, so the two never drift apart. It is what stops a privileged credential becoming a permanent secret shared by everyone who has ever used it.

### Changing the rotation policy

The rotation interval can be set in two places, and they are the same setting:

* In the wizard, on the account card in **Step 2 — Local Accounts**.
* In the **Account Vault** panel, using the edit action on the account row.

### Rotating now

To rotate immediately rather than waiting for the cycle, select the rotate action on the account row.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/bZrhaz9mjnTItcInmEQ0/assets/04.png)

SECUREpass auto-generates a new secure password and changes it on the remote machine.

{% hint style="warning" %}
The current password is replaced and **the action cannot be undone**. If anything outside SECUREpass is using that credential — a script, a scheduled job, a service — it will stop working until it is pointed at the vault.
{% endhint %}

## Break-glass access

Break-glass is a documented way to reach a system in an emergency without waiting for the normal approval. Every use is logged, justified, and reviewed afterwards.

### Enabling it on a system

Turn on **Emergency (Break-Glass)** in the **PAM Security Policy**, in step 1 of the system wizard.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/xyWYenzhvyg7YBj5Bor3/assets/05.png)

{% hint style="info" %}
Break-glass only does something if **Requires Dual Control** is on. Dual control is what makes a session wait for a second person's approval; break-glass is the route around that wait. With dual control already off, there is no approval in the way, so enabling break-glass adds very little. Turn both on together, or neither.
{% endhint %}

### Using it from the Self Service Portal

With break-glass enabled, a user reaches it from the portal.

{% stepper %}
{% step %}

#### Open the system

Open the **Systems** tab under **My Resources** on the dashboard and select the system.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/yEiTG4vub8QVLiQ79aOG/assets/06.png)
{% endstep %}

{% step %}

#### Select Emergency Access

The resource menu offers **Emergency Access** alongside the normal Browser and Native RDP session options.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/8yUDwqDCXhRrb2NWxm37/assets/07.png)
{% endstep %}

{% step %}

#### Confirm emergency access

Selecting it opens the Emergency Access dialog, which warns that the action will be logged and administrators alerted.

![](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/fMGkg3w2GQpyJZGlIK9r/assets/08.png)

The user must:

* Enter an **Emergency Justification** of at least 50 characters describing the emergency and why immediate access is required without normal approval.
* Tick the acknowledgement confirming they understand the access, all commands executed, and the justification will be permanently logged and reviewed by the security team, and that misuse may result in disciplinary action.

Only then does **Confirm Emergency Access** become available.
{% endstep %}
{% endstepper %}

The friction here is deliberate. Break-glass is meant to be usable in a genuine emergency and uncomfortable enough that it is not used casually.

The vault is what makes privileged access survivable: passwords nobody memorises, rotation that runs whether or not anyone remembers, and an emergency route that leaves a written trail behind it.