e-DMZ's Password Auto Repository (PAR) is delivered as a hardware appliance with all the services necessary for it to act as a privileged account password manager. All privileged account passwords are issued based on administratively designed rules. The passwords may be deemed valid for an indefinite life, for finite periods of time or for single purpose activities such as installations, upgrades or configuration changes.

Most all modern operating systems have passwords that can have a short-term life with quick expiration, but what separates PAR from this basic functionality is its ability to keep track of up to 20,000 (PAR 'Standard Edition') or 250K or more with the PAR Enterprise Edition. Arguably, a large organization with more than 1,000 servers and you have multiple administrators that handle different aspects of these servers, that capacity is not out of reach.

PAR replaces stored paper lists and spreadsheets of privileged account passwords, and automates the process of asking for one, getting one, and what happens to the password after issuance.

e-DMZ offers an optional product called e-GuardPost that will record sessions when the password is in use for auditing purposes, in a similar fashion as Quest Privilege Manager does. In our tests, we found that it collects a voluminous amount of information on log sessions, especially when things such as service packs are installed.

Overall, the e-DMZ PAR password storage and issuance system was less evolved than its genetic rival, PowerKeeper. While many features, such as password issuance, can be sophisticated, other features like systems grouping and related user object definition and functions were more difficult to set up and use.

Initial installation of the rack-mounted appliance was trivial, PAR performs no 'discovery' for servers or hosts so we had to ID those ourselves. We could import Windows systems lists to be managed without much issue, but we had to enter that information for all other systems manually, a chore that would be quite tedious if you were pushing this product to its maximum password limits.

PAR doesn't know LDAP and directory services with the same depth as Cyber-Ark's EPV does by design. PAR is focused towards systems (and applications) through more direct logons, rather than pulling that user authentication process via directory services. Large changes in the LDAP structure, such as changing forests and trees, requires a bit of rework within the PAR system to make sure admin passwords stay in sync.

The next step was to define our rules for password strength and create root/administrative-equivalent accounts for the systems we wanted PAR to manage. These accounts handle privileged account expiration and password synchronization, test the viability of the root password accounts for auditing purposes and provide a recovery mechanism in the case of compromised passwords.