About us
Support
Contact
NewsGüvenlik
Why the administrator password should sit in a vault
12 Eylül 2026 · About 3 min
A shared administrator password leaves “who used it” unanswered. A vault, a time limit and approval answer that question.
The administrator on a sticky note
The server, firewall and domain administrator account is the strongest door. If that password sits on a note, in a chat or in a sentence everyone knows, the door is shared. Who entered, what they changed, when they left is unknown.
People assume the password changes when staff leave. In practice it stays as “everyone uses it, we will look later”. A former employee or an outside supporter can fall in with the same account.
What a vault is for
In privileged access the password sits in a vault. When there is a need, an authorised person asks; if there is approval it opens for a time; when the time ends the right drops. PikPAM describes this model: vault, time limit and approval. Those three must sit together to replace a shared note.
The aim is not to slow the work. There is also a path for a night fault; who can open it in an emergency is written in advance. An unwritten emergency path turns back into a sticky note.
It also holds in a small team
“We are three people” does not make a vault unnecessary. In a team of three, one leaves, one goes on leave, one takes outside support. The record is more valuable in a small team because there is no other witness.
A password vault does not have to be a magic list of every company password. Administrator and shared service accounts go in first. A person’s own mail password is a separate topic. If the scope is kept narrow in the quote, the tool is used. Carrying every password on day one locks the project.
Who approves
The person who opens the vault and the person who approves should not be the same. In a small team that looks hard. Then the second person is the on-call manager or the name in the outside-support contract. If both are missing, the emergency path is written and the password is renewed the next day. An unwritten emergency path turns back into a shared note.
Every opened session has a time and a reason. “I looked” is not enough reason. A server update, a locked account or a vendor support session are separate lines. PikPAM keeps this record with a time limit and approval. If the record is not read, the vault is as weak as a notepad. Looking once a month at who opened it makes the tool used.
If you want the scope written for your own office, write from the contact page.