Many teams keep domain admin, firewall, hypervisor and cloud root passwords in a shared folder of their business password manager and call it privileged access management, but a vault only controls who can read a password, not what happens after it is read. Once an administrator copies the password, the vault has no part in the session: it cannot broker the connection, record it, limit it in time, require approval for it or rotate the password when the work is done. Privileged access management (PAM) exists to control exactly that part. This guide is a gap analysis for organisations running shared admin and service accounts out of a business vault: what the vault gives you, which PAM controls are missing, which compensating controls are realistic, and when the gap justifies a PAM platform. It is for IAM leads, infrastructure managers and auditors. For hardening the password manager itself, see Securing the password manager (enterprise) itself; for PAM as a discipline, see the Privileged Access Management Guide.
Key takeaways
- A vault controls disclosure, PAM controls use. A password manager decides who may see a secret; PAM decides who may use privileged access, when, for what reason, through which path, and leaves evidence of what they did.
- Four controls are missing from a vault-only model. Session brokering, session recording, just-in-time elevation and per-use approval are the PAM capabilities a business vault does not provide for shared admin accounts.
- Shared admin passwords outlive the people who saw them. The NCSC advises changing every password a departing administrator could see or use; without rotation after use, every past viewer keeps working credentials.
- Vault logs show retrieval, not activity. A log entry saying a user viewed the domain admin password is not evidence of what that user changed on the domain controller.
- Use both, with clear boundaries. Keep the business vault for team logins and low-risk shared accounts; move tier 0 and other high-impact accounts behind brokering, approval and rotation as soon as the triggers in this guide apply.
The short answer
A business password manager is enough for shared accounts where the impact of misuse is low and the account cannot be made individual: a social media login, a supplier portal, a printer admin page. It is not enough for accounts that can change identity, infrastructure or security controls, such as domain and enterprise admins, hypervisor and backup consoles, network device admin accounts and cloud root or break-glass accounts. For those, the requirement is not a better place to store the password but a control over each use of it. The NCSC is explicit that it does not recommend sharing passwords between individuals, and suggests delegated privileges or alternative authentication instead of sharing; its secure system administration principles add tiered administration, privileged access management and logging of all administration activity. A vault helps with none of those beyond storage.
Control by control: vault vs PAM
| Control | Business password manager | PAM platform | Gap if vault only |
|---|---|---|---|
| Encrypted storage of the credential | Yes, client-side encrypted vaults | Yes, server-side vault | None |
| Who may retrieve it | Shared folder or collection membership | Role and policy, often tied to the target system | Coarse: folder membership is all or nothing per item |
| Credential disclosed to the human | Yes: user sees, copies or autofills the password | Often no: credential injected into a brokered session | Password can be reused outside any control path |
| Session brokering | None: the user connects directly | Proxy or gateway in the path for RDP, SSH, web consoles, databases | No control point between user and target |
| Session recording and command logging | None | Video or keystroke recording, command capture, searchable | No record of what was done |
| Just-in-time elevation | Standing access for every folder member | Access or group membership granted for a window, then removed | Standing privilege for everyone who can open the item |
| Approval per use | None; access is granted once, at folder share | Request with reason and ticket, single or multi-party approval | No intent recorded, no second person |
| Rotation after use | Manual, by a person, if remembered | Automatic check-in rotation on the target | Every past viewer still knows the live password |
| Discovery of privileged accounts | Only what users chose to save | Scans directories, hosts and cloud for privileged accounts | Unknown admin accounts never enter the control |
| Service account rotation with dependencies | None | Rotates and updates services, tasks and app pools that use it | Service passwords never change because rotation breaks things |
| Audit evidence | Item viewed, copied, shared, edited | Who requested, who approved, when, from where, what was done | Cannot answer "what did the administrator do?" |
The comparison is about control model, not quality. A well-run password manager is the right tool for the human passwords it was designed for; see Password Manager vs Secrets Manager for where machine secrets belong instead.
The gap analysis for shared admin accounts
Session brokering
What the vault gives: a password on the clipboard or in an autofill field. What is missing: a control point. With brokering, the administrator authenticates to the PAM gateway as themselves, with MFA, and the gateway opens the RDP, SSH or console session using a credential the administrator never sees. The password cannot be written down, pasted into a script or used from an unmanaged laptop, and the gateway can enforce which targets each person may reach. Compensating control without PAM: restrict where the account can log on from, using jump hosts or privileged access workstations and firewall rules that only allow administrative protocols from those hosts. See Privileged Access Workstations vs Jump Servers.
Session recording
What the vault gives: a log entry that a user retrieved an item. What is missing: the content of the session. NIST SP 800-53 AU-14 (Session Audit) describes the capability to record or view the content of a user session, and AC-6(9) requires logging the execution of privileged functions. Recording also deters misuse and makes incident reconstruction possible. Compensating control without PAM: platform-native logging (Windows security event logging on domain controllers, shell history forwarding, cloud audit logs) sent to a SIEM, accepting that a shared account makes attribution depend on correlating vault retrieval times with logon events. See Session Recording vs Command Filtering.
Just-in-time elevation
What the vault gives: standing access. Everyone in the shared folder can open the domain admin password at 3am on a Sunday. What is missing: time-bound privilege. The NCSC describes just-in-time access as using the standing credential only to request access, with a temporary credential issued on approval, so that a compromised workstation still has to pass the request step and a stolen temporary credential works only briefly. Compensating control without PAM: native time-bound role activation where the platform offers it (cloud identity providers, directory time-limited group membership) and keeping shared folder membership as small as possible. See Credential Vaulting vs Just-in-Time Elevation and Zero Standing Privilege vs Least Privilege.
Approval
What the vault gives: a one-time decision when someone was added to a folder. What is missing: a decision per use. The NCSC lists multi-party approval such as a two-person rule, consensus approval, and rule-based auto-approval linked to a ticket, with each request stating its intent. Approval is also what turns an administrator's action into evidence of an authorised change. Compensating control without PAM: change tickets referenced in the vault item notes and a weekly reconciliation of vault retrievals against tickets. It is detective, not preventive. See Dual control and four-eyes approval for privileged and agent actions.
Rotation after use
What the vault gives: a field you can update manually. What is missing: automatic rotation on check-in, so that a password retrieved for one task is invalid afterwards. Without it, every administrator who has ever opened the item, including leavers, holds a working credential until someone changes it, which is why the NCSC advises changing the passwords a departing administrator could see or use. Compensating control without PAM: a scheduled manual rotation calendar for each shared admin account, plus mandatory rotation on every leaver or role change, tracked as a ticket. For local administrator accounts specifically, Windows LAPS rotates per device; see LAPS vs PAM Vaulting.
Audit evidence
What the vault gives: retrieval logs. The NCSC recommends logging vault access, which passwords were viewed or used, new device enrolment, master password resets and failed unlock attempts, and those logs are worth keeping. What is missing: the link between a person and an action on the target. NIST SP 800-53 IA-2(5) requires users to be individually authenticated before access to shared accounts is granted; a vault does that for retrieval, but the target system still sees only the shared account name. Auditors asking "who changed this firewall rule?" get a list of people who opened the item that week.
The second gap: shared service accounts
Service account passwords stored in a business vault are the same problem in a harder form. The vault holds a copy for humans, while the real use is by services, scheduled tasks, application pools and scripts that hold their own copy. Rotating the vault entry changes nothing; rotating the account breaks every dependency nobody recorded. The result is service passwords that never change and are known to every engineer who ever opened the folder. PAM platforms with dependency-aware rotation, group managed service accounts, and workload identity remove the human copy altogether. See the Service Account Security Guide.
Threat model for each option
Vault-only model
Threats: credential theft from the administrator's endpoint (keylogging, infostealers, ATT&CK T1555.005 Credentials from Password Stores: Password Managers), then use of the stolen shared account as a valid account (T1078.002 Domain Accounts) from anywhere the account can log on. Insider misuse is hard to attribute. Leavers retain knowledge of live passwords. Architecture in words: administrators unlock a personal vault on their own device, retrieve the shared password and connect directly to the target; the security boundary is the administrator's endpoint and vault login. Characteristic failure: a privileged secret in a person's vault inherits every weakness of that person's device and login.
PAM model
Threats: compromise of the PAM platform itself, which concentrates every privileged credential; abuse of PAM administrator roles; bypass routes where the target still accepts direct logons; session hijacking of brokered sessions (T1563 Remote Service Session Hijacking). Architecture in words: administrators authenticate to the PAM service as individuals with MFA from managed devices, request access, receive approval, and work through a brokered, recorded session; the credential is rotated afterwards. Characteristic failure: PAM deployed as a second vault, with credentials checked out and pasted, and no brokering or rotation enabled. The NCSC requires the PAM service itself to be patched, monitored and protected, with a protected break-glass route for when it is unavailable; Microsoft's privileged access guidance warns that implementing a PIM or PAM solution alone is not sufficient without securing devices, intermediaries and sessions end to end.
Choosing: when the gap justifies PAM
| Trigger | Why it matters | Response |
|---|---|---|
| Tier 0 accounts (domain, identity provider, backup, hypervisor) are in a shared folder | Compromise of one item is compromise of the estate | Move first: brokering, approval and rotation, or replace with individual named admin accounts |
| An auditor or regulator asks for evidence of what privileged users did | Retrieval logs cannot answer it | Session recording on the in-scope systems |
| More than a handful of people can open each admin item | Standing access and attribution degrade with every member | JIT access and per-use approval |
| Shared passwords are not rotated after leavers | Former staff retain working credentials | Automatic rotation on check-in and on leaver events |
| Service account passwords have never changed | Rotation is avoided because dependencies are unknown | Dependency discovery and managed rotation, or gMSA and workload identity |
| Third parties and contractors administer systems | External devices are outside your endpoint controls | Brokered, recorded, time-limited access with no password disclosure |
Small organisations (one or two administrators, a few dozen servers) can often close most of the gap without a PAM platform: named admin accounts instead of shared ones, MFA on every admin logon, Windows LAPS for local admin, native time-bound role activation in the cloud, a jump host, and a short list of genuinely shared accounts kept in the vault with rotation on every leaver. Larger organisations, or any organisation with external administrators or audit obligations on privileged activity, need the brokering, recording and approval only a PAM layer provides. See the PAM Maturity Model.
Worked scenarios
Scenario 1, 80-person professional services firm: two IT staff and an outsourced network provider share one vault folder holding the domain admin, firewall, hypervisor and Microsoft 365 global admin passwords. The gap analysis finds standing access for five people, no record of the provider's changes and no rotation since a technician left. Without buying PAM, the firm creates named admin accounts for each internal administrator, enforces MFA, removes the domain admin password from the shared folder and seals it as a break-glass credential, uses time-bound role activation for cloud admin, gives the provider a dedicated account restricted to the firewall management interface from its own source address, and rotates every remaining shared item. The residual gap is session recording for the provider, which the firm accepts and documents.
Scenario 2, 3,000-person manufacturer: forty engineers use a vault folder for production database, OT historian and backup console credentials, and a regulator's audit asks for evidence of privileged activity. Here the compensating controls do not scale. The firm deploys PAM for tier 0 and production systems first: brokered RDP and SSH with recording, approval linked to change tickets, rotation on check-in, and discovery of local and service accounts. The vault stays for team logins to SaaS tools and supplier portals. Direct logons to the brokered targets are blocked at the firewall so that the PAM path cannot be bypassed.
How to implement: closing the gap
- Inventory shared items: export the list (not the contents) of every shared folder item and classify each as tier 0, high impact, or low impact. Record owners and how many people can open each.
- Eliminate before you control: replace shared accounts with named individual admin accounts wherever the platform allows. Every account removed is a gap closed.
- Rotate now: change every shared admin password that a leaver could have seen, then set a rotation schedule.
- Apply compensating controls: MFA on target logons, jump hosts or privileged access workstations, native time-bound roles, and SIEM correlation of vault retrievals with target logons.
- Pilot PAM on tier 0: broker and record a small set of the highest-impact targets with a few administrators, in parallel with existing access, and test recording quality and approval flow.
- Enforce the path: block direct administrative logons to brokered targets, enable rotation on check-in, and remove the corresponding vault items.
- Extend by ring: production servers, network devices, databases, then service accounts with dependency-aware rotation.
- Rollback and break-glass: keep sealed break-glass credentials for each critical system outside the PAM platform, test them quarterly, and be able to re-open direct access for one target group while a PAM fault is fixed. See the Break-Glass Account Guide.
Detection and measurement
Whichever model you run, forward vault audit events (item viewed, copied, exported, shared, folder membership changes, master password resets) and PAM events (requests, approvals, session start and end, rotation results) to the SIEM. Alert on retrieval of tier 0 items outside change windows, on logons with shared admin accounts that have no matching retrieval or session, on direct logons to brokered targets, and on failed rotations.
| Metric | What it shows | Direction |
|---|---|---|
| Shared admin accounts remaining (count) | Progress replacing shared with named accounts | Down |
| Tier 0 privileged sessions brokered and recorded (%) | Coverage of the highest-impact access | Up to 100% |
| People with standing access per shared admin item (median) | Standing privilege exposure | Down |
| Shared admin passwords older than the rotation policy (count) | Rotation discipline | Zero |
| Privileged logons with no matching request or session (count) | Bypass of the control path | Zero |
| Leaver events with completed rotation of exposed items (%) | Leaver hygiene | 100% |
Common failure patterns
- Privileged keys in a person's vault: in the LastPass Breach 2022, an attacker keylogged an engineer's home computer, captured the vault master password after MFA, and used cloud access keys and backup decryption keys stored in the corporate vault. The customer-side lesson for any organisation is that a privileged secret in a person's vault inherits that person's endpoint and login weaknesses.
- PAM bought, used as a vault: credentials are checked out and pasted, brokering and rotation are never switched on, and the gaps in this guide remain under a new name.
- Direct logons left open: brokered targets still accept RDP or SSH from the whole network, so anyone with the password skips approval and recording.
- Folder sprawl: shared folders grow by convenience until most of IT can open the domain admin item, and nobody reviews membership.
- No rotation on leaver: HR offboarding disables the leaver's accounts but not the shared passwords they knew.
- No break-glass outside PAM: the PAM platform fails or is caught in a ransomware event and nobody can reach the systems needed to recover it. See Recovering IAM and PAM After Ransomware or Domain Compromise.
Framework mapping
| Framework | Reference | What the vault covers | What needs PAM or compensating controls |
|---|---|---|---|
| NIST SP 800-53 Rev. 5 | IA-2(5) Individual Authentication with Group Authentication; AC-2(9) Restrictions on Use of Shared and Group Accounts | Individual authentication to retrieve the shared password | Individual attribution on the target; conditions limiting shared account use |
| NIST SP 800-53 Rev. 5 | AC-2(7) Privileged User Accounts; AC-6(5) Privileged Accounts | Limiting who can open admin items | Monitoring and revoking privileged assignments, time-bound access |
| NIST SP 800-53 Rev. 5 | AU-14 Session Audit; AC-6(9) Log Use of Privileged Functions | Retrieval logs only | Session content and privileged function logging |
| NIST SP 800-53 Rev. 5 | IA-2(1) Multi-factor Authentication to Privileged Accounts | MFA to unlock the vault | MFA at the privileged logon itself |
| NIST CSF 2.0 | PR.AA-05; DE.CM-03 | Defined access to stored credentials | Least privilege enforced per use; monitoring of personnel activity |
| CIS Controls v8.1 | Control 5 Account Management; Control 6 Access Control Management | Credential storage for administrator accounts | Managing and revoking administrator and service account privileges |
| MITRE ATT&CK | T1555.005; T1078.002; T1563 | Target of credential theft | Brokering removes disclosure; PAM must defend brokered sessions |
Practitioner checklist
- List every shared admin and service account in the business vault, with owner, tier and number of people who can open it.
- Replace shared admin accounts with named individual accounts wherever the platform allows.
- Rotate every shared admin password a leaver could have seen, and make rotation part of offboarding.
- Require MFA at privileged logons, not only at vault unlock.
- Restrict administrative logons to jump hosts or privileged access workstations.
- Broker and record tier 0 and third-party administrative sessions, with approval linked to change tickets.
- Block direct logons to brokered targets so the control path cannot be bypassed.
- Correlate vault retrievals and PAM sessions with target logons in the SIEM.
- Keep tested break-glass credentials for critical systems outside the PAM platform.
Standards and references
- NCSC: Password manager buyers guide
- NCSC: Secure system administration
- NCSC: Use privileged access management
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls v8.1
- Microsoft: Developing a privileged access strategy
- MITRE ATT&CK: Credentials from Password Stores: Password Managers
Related NHI Mgmt Group resources: Privileged Access Management Guide, Securing the password manager (enterprise) itself, Credential Vaulting vs Just-in-Time Elevation, LAPS vs PAM Vaulting, PAM Buyer's Guide.