---
title: Set Manual Password for Dynamic Vault Accounts
slug: kronpam-reference-guide-3-9-0/set-manual-password-for-dynamic-vault-accounts
docTags: 
createdAt: 2024-12-02T13:59:28.149Z
---

The Vault module periodically changes the passwords of dynamic vault accounts. The Password Vault's password generation algorithm creates random passwords and assigns them to accounts.

You can also assign a password of your choosing to an account for a specified duration, instead of waiting for the next automatic change. This applies to dynamic accounts and to static accounts, except accounts that use the **STATIC** strategy (static accounts without a target device). Once a manually assigned password expires on a dynamic account, Kron PAM automatically generates and assigns a new random password. Static accounts don't change automatically, so a manually set password stays in effect until you change it again.

To set a manual password for the dynamic Vault account, the **single.connect.sapm.set.password.manual **function is necessary to include in the function realm.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/DVkCtRMZqm0akwi4g9wG__image.png" size="76" width="944" height="370" position="center" caption="Function / Realm Definition Screen" darkWidth="944" darkHeight="370" showCaption="true"}

With this definition, users in the relevant group who have the **Manage Password** permission or higher see the **Set Password** button enabled on the **Vault** screen. This button is functional for dynamic vault accounts, and for static vault accounts other than those using the **STATIC** strategy.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/KJjnHjZIUKZdoKIkp-ONS_image.png "Figure – User Definition Screen")

A parameter called **Set Password Manually **is on the **Vault Configuration > Password Change **group pop-up. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/1tCJyCqEXpnUBoAe2gFn3_image.png "Figure – Vault Configuration Definition Screen")

Suppose the user has the** Set Manual Password **function from the **Portal Definition **screen and the **Set Password Manually **option is set to **On **in the **Vault Configuration **screen. In that case, the **Set Manually Password** option will become available on the Vault Definition screen.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/L2c0ussOFCW0qnMGAT7EB_image.png)

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/p5V141k2tH88MNwxwJA2y_image.png "Figure – Vault Select Action Screen")

Even if this parameter is defined as **True **in the **Portal Function**, Kron PAM can ensure that some Vault Accounts cannot manually set passwords according to Vault Configurations.

If the** Set Manual Password** function isn’t defined as **False** on the **Portal Function** in this case system will not enable the user on the Vault Password Change popup even if **Set Password Manually** is defined as **True** on the Vault Configuration screen. 

When the user clicks the **Set Manual Password** button, the **Set Manual Password** step opens, where the user enters a new password. If no specific password configuration rule is defined for the relevant vault configuration, the screen displays information stating that the default password will use three uppercase letters, three lowercase letters, and two numbers.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/prwup73dX30TaaZDp5dT5_image.png" size="60" isUploading="false" width="692" height="784" darkWidth="692" darkHeight="784" showCaption="false"}

If the vault configuration defines Password Creation Criteria for the account (for example, a minimum number of uppercase letters, lowercase letters, or numbers), Kron PAM displays these requirements on the screen. If the user enters a password that doesn't meet them and clicks **Set Manual Password**, Kron PAM displays a warning message instead of saving it.

To generate a random password that meets these requirements instead of typing one, click the generate icon next to the **New Password** field. This opens the random password generation screen.

Kron PAM validates the entered password by connecting to the target device, then sets it there.

For **dynamic** accounts, when the user enters the password value and clicks **Next**, a pop-up appears where the user can select how long the password will be used and enter a comment.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/WTD4xv0UNqfsAoqQPC5uC_image.png" size="40" caption="Figure – Set Password Manually Duration Select Screen" isUploading="false" width="538" height="964" darkWidth="538" darkHeight="964" showCaption="true"}

:::hint{type="info"}
Possible values for the Duration Time are configured with the “**sapm.set.manual.password.expiration.time.values**” property from the System Config. Man. screen. If user doesn’t define this parameter, the default value is “30m”. Options are separated with commas, “m” stands for minutes, and “h” stands for hours.
:::

For static accounts, this duration step doesn't apply. After the user enters a comment and clicks Set Manual Password, Kron PAM changes the password immediately, both on the target device and in the Password Vault database, and doesn't schedule any further automatic or random password change.

A new log type will be added to the Vault Log screen, and if a user performs the **Set Manual Password **action for any account, this will be logged as such.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/l0zhCKt7HSWYrVnQ0OIa4_image.png "Vault Log Listed Screen")