Get-PASAccount returns only 100 accounts

[SecurityAura]

• PowerShell Version: 5.1
• psPAS Branch & Version: 2.4.8
• CyberArk Version: 10.8

Expected Behaviour

When using the Get-PASAccount on CyberArk v10.4 and above, if multiple accounts are found in a search, all of them should be returned, and the exact number of matching accounts should be returned as well.

Current Behaviour

At the moment, when using Get-PASAccount on CyberArk v10.8, multiple accounts are found in a search, however, it seems to cap the limit of accounts returned at 100.

Possible Solution

Could be a limitation with either the CyberArk API itself, or psPAS.

Steps to Reproduce (for bug reports)

1 . Import-Module psPAS 2 . $creds = Get-Credential 3 . $token = New-PASSession -Credential $creds -BaseURI https://PVWA-URL-REDACTED.com -Verbose 4 . $accounts = $token | Get-PASAccount -Search "$SEARCH_TERM_OF_ABOVE_100_RESULTS"

5. $accounts.Length

Sample Output

PS C:\Users\Aura> $accounts.Length
100

Context

I'm trying to get a list of all the accounts in the Vault that matches a certain keyword (search), however, if there are more than 100 accounts in that search, I need all of them.

Edit: I just checked in the API documentation, and assuming that Get-PASAccount uses "Get accounts", the limit should be 1,000.

Parameter	Limit
Type	Number
Description	Maximum number of returned accounts. If not specified, the default value is 50. The maximum number that can be specified is 1000.When used together with the Offset parameter, this value determines the number of accounts to return, starting from the first account that is returned.

That 1,000 limit is also seen in the Get-PASAccount method.

[parameter(
            Mandatory = $false,
            ValueFromPipelinebyPropertyName = $true,
            ParameterSetName = "v10ByQuery"
        )]
        [ValidateRange(1, 1000)]
        [int]$limit,

Edit 2: Seems that if I use the "-Limit" parameter and set it to 1000, it works. However, I think that by defaults, all accounts should be returned, and not just the first 100 as it can be misleading.

[pspete]

Hi @Aurakal . it looks like you have discovered that you can use the parameters available to work past your issue - you can likely combine -limit with -offset to get more results too.

[SecurityAura]

Hi @pspete

Yup, I did. Maybe this default limit should be documented somehow though, or at least dropped (in that case, take that "Issue" as an enhancement request if that's okay with you).

[pspete]

I'll add a clarification to the help text for the parameter in the next release of the module

[SecurityAura]

Awesome, thank you.