PAM Client Fails to Launch For Domain Users After Silent Installation

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

The PAM Client is registered in a Software Distribution Catalogue for silent installation to Domain member windows machines. The installation is successful, but the PAM client does not launch for members of Domain Users. What is the requirement for a PAM silent installation for Domain Users?

Cause

Per the Deploy the PAM Client documentation page, the PAM client directory requires the "Full Control" permission for any user which intends to use it. In this case, the Domain Users did not have this permission.

Resolution

If the PAM Client will be launched by multiple users on the same Windows server, provide the "Full Control" permission to either "Everyone" or "Domain Users" for the PAM client directory.

If it is not possible to provide the "Full Control" permission to neither "Everyone" nor "Domain Users" due to security concerns, update the Software Distribution script to assign specific Domain accounts to have the "Full Control" permission to that folder using "icacls".

For example:
icacls %PAM_CLIENT_FOLDER% /remove:d /grant %END_USER_ACCOUNT%:(OI)(CI)F /T

%PAM_CLIENT_FOLDER% is the PAM Client installation folder.
%END_USER_ACCOUNT% is the end user domain account
/remove:d would remove any explicit DENY permission that might have been set which might conflict with the end user permission
(OI)(CI)F would give FULL permission to any new files/folders that might be created in the future
/T applies this to existing files/folders currently exist