> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Change Secrets


Enterprise Edition

**Change Secrets** requires JumpServer Enterprise Edition. Without a license, the Security > Change Secrets tabs are disabled.

[Request 14-day free trial](https://www.jumpserver.com/free-trial)

Change Secrets rotates the credentials of accounts stored in JumpServer. A change-secret task can run immediately or on a schedule, generate a specific or random secret, and notify recipients by email when it finishes.

A change-secret task authenticates through a privileged account on the asset, so the asset's account list must contain a working privileged account.

## Prerequisites

- Access to **PAM > Security > Change Secrets** with permission to view change-secret tasks.
- The target assets or nodes already exist. See [Assets](https://www.jumpserver.com/docs/features/console/assets/index.md).
- Each target account has secret change enabled. See [Accounts](https://www.jumpserver.com/docs/features/console/accounts/index.md).
- A privileged account is available on the asset and can authenticate to it.

## Overview

The page contains five tabs:

- **Overview** – summary counts, success and failure trend, and failed-account list.
- **Change secret tasks** – task definitions and schedules.
- **Execution history** – one row per run with status, duration, and log.
- **Execution records** – per-account results, with old and new secret access.
- **Change secret status** – in-progress changes, shown when the change-after-session setting is enabled.

![Figure 1: Change secret overview with task summary and failure trend](/images/v5/jumpserver/v5_admin_secret_02.png)

## Create a change secret task


1

At the top-left of the page, select , then click  **PAM**.

![image](/docs/images/docs/navs/nav-pam.png)

2

Open **Security > Change Secrets** and select **Change secret tasks**.

3

Click **Create**.

4

In the **Name** field, type the task name.

5

In the **Accounts** field, type the usernames to rotate and press Enter after each.

6

In the **Assets** and **Nodes** fields, select the targets. The two fields can be combined.

7

Choose the **Secret strategy** (**Specific secret** or **Random generate**), the **Secret type** (**Password** or **SSH key**), and then supply the **Password**, **Private key**, and optional **Key password**, or the **Password rules** for random generation.

8

Optionally configure **Parameters** for the platform, enable **Periodic** to schedule the task, keep **Check connection after change** enabled, leave **Active** selected, and add **Recipients** for email notification.

9

Click **Submit**.

## Field reference

| Field                             | Description                                                                       |
| --------------------------------- | --------------------------------------------------------------------------------- |
| **Name**                          | Required. Task name.                                                              |
| **Accounts**                      | Required. Usernames whose secrets are rotated.                                    |
| **Assets / Nodes**                | Targets of the change; both can be selected.                                      |
| **Secret strategy**               | **Specific secret** or **Random generate**.                                       |
| **Secret type**                   | **Password** or **SSH key**.                                                      |
| **Password**                      | Value to set when the strategy is specific and the type is password.              |
| **Password rules**                | Length and character rules used when generating a random password.                |
| **Parameters**                    | Platform-specific change parameters. Applies to AIX, Linux, and Unix assets only. |
| **Periodic**                      | Repeats the task on a schedule; crontab takes priority over interval.             |
| **Check connection after change** | Verifies the new secret by connecting. Enabled by default.                        |
| **Recipients**                    | Users notified by email after execution.                                          |
| **Active**                        | Enables the task.                                                                 |
| **Comment**                       | Optional notes.                                                                   |

![Figure 2: Create account secret change drawer](/images/v5/jumpserver/v5_admin_secret_03.png)


Note

Do not place accounts that share a _switch from_ relationship on the same asset into one task. Split them into two tasks and rotate them separately, because the first change can invalidate the account that the second change depends on.

## How privileged accounts are handled


Warning

By default JumpServer does not change the secrets of privileged accounts, nor of accounts named `root` or `administrator`, and it excludes the privileged account used to run the task. To allow privileged-account rotation, set `CHANGE_AUTH_PLAN_SECURE_MODE_ENABLED=false` in the configuration file and restart the JumpServer service.

Because this changes a high-risk credential, use a separate, controlled task for privileged accounts and test it on a non-production asset first.

## Run and review

Use the green run button in the row, or open the task and use the manual execution action, to start a change. The **More** menu provides **Edit**, **Delete**, and **Duplicate**.

The **Overview** tab summarizes today, the last 7 days, or the last 30 days: task counts (total, periodic, asset management), execution counts (total, success, failed), and running changes. The **Account secret change success/failure** chart plots success against failure, and the failed-account list shows each failure with its error.

**Execution records** lists the changed accounts with asset, username, end date, success, test, and error. Opening a record requires MFA verification before the old and new secrets are shown, and a failed change can be retried from there.