---
updatedAt: 2026-04-01T17:59:53.000Z
---

# Disabled at Rest managed accounts | PS On-prem

## What is Just-in-Time?

Just-in-Time (JIT) is a critical aspect of controlling access to assets and identities within an organization. When flagged by a Password Safe administrator, Active Directory and Entra ID accounts can leverage JIT capabilities by disabling these accounts when checked in to Password Safe.

## How is it useful?

When a requestor checks out a disabled account, a workflow is initiated that re-enables the account for use. Once checked back in, the account is disabled again. When enabling or disabling an account, Password Safe uses the **Preferred Domain Controller** (DC), if set, for the managed account.

> ℹ️
>
> The **Disabled at Rest** feature is only available for Active Directory (AD) and Entra ID accounts.

## Enable the Disabled at Rest setting

The **Disabled at Rest** setting can be activated by using a toggle switch, located in **Managed Accounts > Account Settings**, or by creating a Smart Rule.

### Enable Disabled at Rest with toggle switch

1. Open a browser and enter the URL for your Password Safe instance: **https\://\<hostname>/WebConsole/index.html**.
2. Enter your username and password.
3. From the left menu, click ![Managed Accounts icon](https://files.readme.io/ce06224851f554e4f4bdc3262ca25fcd00aaf1266a016e416e96b72bd93b20bc-managed-accounts.png).\
   The **Managed Accounts** page displays.
4. Locate the managed account in the grid.
5. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Edit Account**.

   ![Select Edit Account](https://files.readme.io/0095f6a7a3fdcce407e36d2fcd694c2f19211489701356b9ac286f07d07e0b61-image.png)
6. Under **Account Settings**, click the **Disabled at Rest** toggle to enable the setting.
7. Click **Update Account**.

### Create a Smart Rule for Disabled at Rest accounts

In addition to setting the **Disabled at Rest** option in an individual managed account, you can also set the **Disabled at Rest** flag by creating a smart rule. The flag automatically turns on the **Disabled at Rest** setting for all matching accounts included in the smart rule, as follows:

1. From the left menu, click ![Smart Rules icon](https://files.readme.io/bdb02c35ba2303e590077ff55e7ad9560a6c7be669fe6593838210ab93b6e091-smart-rules.png).\
   The **Smart Rules** page displays.

2. From the **Smart Rule Type filter** dropdown, select **Managed Account**.

3. Click **+ Create Smart Rule**.

4. Select **Managed Account Settings for Disabled at Rest Accounts** under **Actions**.

5. Under **Platform**, select either **Active Directory** or **Microsoft Entra ID**.

6. Complete the remaining settings.

7. Click **Create Smart Rule**.

> 🚧 Important information
>
> If the **Disabled At Rest** setting is set at the account level, it is overwritten by the **Manage Account Settings** action in a Smart Rule, which sets **Disabled at Rest** for all affected accounts to **No**. You must use the **Manage Account Settings for Disabled At Rest Accounts** action instead, which sets **Disabled at Rest** for all affected accounts to **Yes**.

> ℹ️
>
> * Concurrent accounts, those that are used by multiple users, are disabled only after the account is no longer in use by anyone.
> * The **Disabled at Rest** feature is not supported with Password Cache. This service checks out the account it is configured for and keeps a cache locally. The cache is an active request, meaning the cached account is enabled, and it will stay enabled.

## Verify Disabled at Rest setting

To verify that the **Disabled at Rest** setting is enabled:

1. From the left menu, click ![Smart Rules icon](https://files.readme.io/bdb02c35ba2303e590077ff55e7ad9560a6c7be669fe6593838210ab93b6e091-smart-rules.png).\
   The **Smart Rules** page displays.

2. From the **Smart Rule Type filter** dropdown, select **Managed Account**.

3. Locate the managed account created above.

4. Click ![Ellipsis icon](https://files.readme.io/6510db312bf2b69a8e3e5467df7161eb719d09832984ab66f99a928f94d4c54c-ellipsis.png) **> Go to Advanced Details**.

5. Under **Details & Attributes > Account Settings**, verify that **Disabled at Rest** to **Yes**.

Changes can also be viewed under **User Audits**, as follows:

1. From the left menu, click ![Configuration icon](https://files.readme.io/5440329f4c22243ec1f8721a1c3d821fa7d6b7468cd0904e01869dc74e6cf354-configuration.png).\
   The **Configuration** page displays.
2. Under **General**,  select **User Audits**.\
   The **User Audits** page displays.
3. Click ![Information icon](https://files.readme.io/d076d37010709806a738f1a1566892b798382ff54fbbb9bc1c6fbb9df3453776-info.png) to the right of the updated item. The **Details** pane displays the action that was taken and the changes made.

## Sample Disabled At Rest workflow description

Disabled accounts are temporarily enabled when a new Password Safe request is made. Using the **View Password** request as an example, view the workflow:

1. From the left menu, click ![Password Safe icon](https://files.readme.io/33e5644ccf721aba517203611845f5622ba4e4869431fa5158593561f37a889c-ps-icon.png).\
   The **Password Safe** home page displays.
2. Click  the **Accounts** tab.
3. Select **Directory Linked Accounts**.
4. Locate the account in the grid.
5. Click **Access** to the right of the request.
6. In the **Access** panel, under **Quick Launch**, set the time length of the session.
7. Click **Retrieve Password**.
   * The account is now enabled.
   * It remains enabled for the duration of the session. If the user checks-in the request or the request expiry time is reached (whichever comes first), the account is queued to be disabled.

> ℹ️
>
> When enabling the **Disable at Rest** feature on a managed account, the account is set to disabled in AD or Entra ID. If the account does not become disabled, a check out/check in may be required.

## Affected settings

When your account is set to **Disabled at Rest**, the following settings are not available:

* **Account Settings > Use Own Credentials**.
* **Account Settings > Directory Query Enabled**
* **Scanner Settings > Scanner Enabled**
* **Managed Account > Advanced Details > Propagation Actions**
* **Test Password** is not available in the ellipsis menu.

> ℹ️
>
> For more information about site replication considerations when leveraging the **Disable at Rest** feature, refer to your Active Directory administrators.