PAM-UI-1502 and PAM-CMN-5484 - unable to delete device

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We cannot delete any device from PAM that has device type Password Management checked. All attempts fail with error 
Error: PAM-UI-1502: Device <name> cannot be deleted as there is an account checked out by user.

And the session logs show a corresponding message:
PAM-CMN-5484: Device <name> cannot be deleted as there is an account checked out by user.

This includes devices that don't even have a target application or account defined for them.

There are times where the deletions work, but the problem keeps coming back.

Environment

Release : 4.1.1-4.1.3

Cause

Before deleting a device, PAM needs to evaluate if any account associated with the device currently is checked out in a custom workflow, in which case the account and therefore the device should not be deleted. Otherwise a temporary account created for the custom workflow could be left behind in the remote application. Due to a bug this evaluation reported an error, if any target account was checked out for a custom workflow, no matter which device the account belonged to.

Resolution

This problem will be fixed in 4.1.5+ and 4.2+. If you run at an affected release and need a solution before you can upgrade to a version that includes the fix, please open a case with PAM Support.