CA PAM Client showing blank screen after connecting to PAM and entering credentials

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

The CA PAM Client does not seem to be operational with terminal services for Server 2016.  Users only get a blank screen after launching the client and connecting to a PAM server. 

The same issue has been seen on VDI PAM Client instances and on Windows 2019 servers. It may be seen on any Windows host where the PAM client is installed for use by more than one user.

Cause

The PAM client installation folder and subfolders were not writable by the user(s) launching the client. The server admin had assumed that the PAM client would write files to each user's AppData folder and users would not need Modify and Write permissions under the installation folder in Program Files (x86).

Resolution

The PAM client writes cache and temporary files into folders under the installation folder, not into user's AppData folders, and updates files in the installation folder itself. Thus all users launching the client need to have Modify and Write permissions on the installation folder and subfolders. Changing the folder permissions resolved the problem.

Additional Information

Given that different instances of the PAM client write to the same folders and files, the client cannot be used by multiple users in parallel. A single user can launch multiple PAM client instances, as long as they connect to PAM servers running the same release. If you have PAM servers on different releases, you should install multiple PAM clients into different folders, one for each PAM release.