Shared Workstations

Shared workstation environments allow multiple users to authenticate on the same physical machine using their individual identities, then access shared or privileged accounts managed by CyberArk.

---

Overview

In a shared workstation deployment, no individual user has a dedicated Windows session. Instead:

1. A user approaches the workstation and authenticates their personal identity using a 1Kosmos MFA method (typically 1Key biometric authentication).
2. The Credential Provider queries CyberArk PAM for the list of shared accounts that user is authorised to access.
3. The user selects the appropriate shared account from the list.
4. Windows opens a session under the selected shared account.

This model is common in manufacturing, healthcare, retail, and contact centre environments where employees share terminals but individual accountability must be maintained.

Note: The authentication steps for shared account login are documented in FIDO / 1Key, Shared Account Login with 1Key. This page covers the deployment prerequisites, CyberArk integration setup, and environment-specific configuration.

---

Admin Setup

Prerequisites

Requirement	Detail
CyberArk PAM	CyberArk Privileged Access Management deployed and configured in your environment
1Key hardware key	Each user must have a 1Key enrolled; see 1Key Enrollment Documentation
Agent version	Credential Provider installed on all shared workstations
CyberArk integration	1Kosmos–CyberArk integration configured in AdminX (see below)
User entitlements	Each user's CyberArk entitlements must be configured to reflect the shared accounts they are authorised to access

Configure the CyberArk Integration in AdminX

1. In AdminX, navigate to Integrations > CyberArk PAM.
2. Enter your CyberArk server URL, application ID, and API credentials.
3. Test the connection to verify AdminX can communicate with CyberArk.
4. Save the integration settings.

Configure the Authentication Journey

1. In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.
2. Create a new journey or edit an existing one.
3. Under Authentication Method, select FIDO for Shared Account Login.
4. Assign the journey to the user group or machine policy covering all shared workstation users.
5. Save and publish the journey.

Note: The FIDO for Shared Account Login journey type triggers the CyberArk account lookup after successful biometric authentication. Journeys configured with the standard FIDO method will not present the shared account selection screen.

Workstation Configuration

Shared workstations typically auto-lock after a short idle period to ensure the session is always in a locked state when a new user approaches.

1. Configure the Windows screen lock timeout via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > Interactive Logon: Machine inactivity limit.
2. Set the inactivity limit to a value appropriate for your environment (e.g., 60–120 seconds).
3. Optionally, configure the workstation to display a custom lock screen message (e.g., "Place your 1Key to log in") via Group Policy: Computer Configuration > Administrative Templates > Control Panel > Personalization > Force a specific lock screen image.

---

User Guide

See FIDO / 1Key, Shared Account Login with 1Key for the step-by-step login flow.

---

Troubleshooting

Issue	Likely Cause	Resolution
Shared account list does not appear after biometric authentication	Journey configured with standard FIDO instead of FIDO for Shared Account Login; CyberArk integration not configured	Verify the journey uses the FIDO for Shared Account Login method; verify the CyberArk integration is configured and connected in AdminX
Expected shared account not visible in the list	User's CyberArk entitlement not granted for that account	Verify the user's CyberArk account permissions with your PAM administrator
1Key not recognised at the workstation	Key not enrolled; USB connection issue; Credential Provider not running	Try a different USB port; verify key enrollment; confirm the Credential Provider service is running
CyberArk connection error in AdminX	API credentials expired or incorrect; network connectivity between 1Kosmos and CyberArk lost	Re-enter and test CyberArk API credentials in AdminX Integrations > CyberArk PAM; verify network connectivity
Session not locking between users	Inactivity timeout not configured; GPO not applied to workstation	Verify the GPO inactivity policy is applied and effective on the workstation using gpresult /h report.html