When an account is unable to change its own password, how can you ensure that password reset with the reconcile account is performed each time…

The question asks how to configure the CPM to use a reconcile account for a password change when the target account itself lacks the permissions to change its own password. The parameter ChangePasswordInResetMode (option B contains a common typo, "Made" instead of "Mode") directly addresses this scenario. When ChangePasswordInResetMode is set to Yes, it instructs the CPM to perform the standard 'Change' operation by using the associated reconcile account to log in and reset the password, rather than logging in as the target account. This effectively replaces the 'change' action with a 'reset' action, fulfilling the requirement.

A. Set the parameter RCAllowManualReconciliation to Yes.

This parameter only enables users with appropriate permissions to manually trigger a reconciliation from the PVWA interface; it does not affect automatic password management processes.

C. Set the parameter IgnoreReconcileOnMissingAccount to No.

This parameter triggers a reconcile action only if a change or verification fails because the account is not found on the target system, which is a different scenario.

D. Set the UnlockUserOnReconcile to Yes.

This parameter instructs the CPM to attempt to unlock a locked account during a reconcile process; it does not trigger the reconcile or alter the change process.

1. CyberArk Privileged Access Manager Documentation - v12.6

"Platforms - Password Change":

Section: Platform Properties > Automatic Password Management > Password Change

Parameter: ChangePasswordInResetMode

Content: "Whether the CPM changes the password in reset mode or by logging on to the remote machine with the password's user.

Yes – The CPM uses the reconcile account to log on to the remote machine and change the password of the required account.

No – The CPM logs on to the remote machine with the password's user and then changes the password.

This parameter is used for accounts that do not have permission to change their own passwords."

This directly confirms that setting this parameter to 'Yes' achieves the exact outcome described in the question.

2. CyberArk Privileged Access Manager Documentation - v12.6

"Platforms - Password Reconciliation":

Section: Platform Properties > Automatic Password Management > Password Reconciliation

Parameter: RCAllowManualReconciliation

Content: "Whether or not users who have the appropriate permissions on an account can initiate a reconcile action manually."

This confirms that option A is for manual actions only.