Password Safe password history retention for more than one year

You have the option to create a Secrets Folder within Secrets Safe and set up a Propagation Action. This way, every time the password is changed, a new credential is created—using a naming convention like 'Account+Month+Year'—and the latest password is saved there. If you change it monthly, you could also use 'Account+Day+Month+Year' for weekly rotations.

You could apply this either to specific critical servers or across all servers. You can then clean up old entries manually or use the API to automatically delete 'old' entries as soon as a new one is created.

This approach works well; I have implemented it for one of our customers. It has been running for two years now, and so far, they have achieved a 92% success rate for restores.

​@PatC Here a example of the script and the instructions to use:
 

Script Arguments: In your Propagation Action configuration, ensure you pass the arguments in the order the script expects: "%u" "%p" "Month" (or "Weekly").
 

%u = Managed Account UserName

%p = Managed Account Password
 

Folder ID: You must first find the GUID of your target folder. You can find this by calling GET Secrets-Safe/Folders/.

Permissions: The "RunAs" user specified in the script must have Read/Write access to Secrets Safe  and the specific folder you are targeting.

API Key: Ensure the API key used is associated with a user who has the "Secrets Safe" feature/permission enabled.