No more than 2 simultaneous sessions allowed to a Windows server - PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A Windows server has been provisioned for access with Computer Access Licenses (CAL) so that several simultaneous connections are possible.

The license server is working fine and there are multiple connections possible to the RDP server when operating outside PAM.

However, when access is attempted from PAM only two simultaneous sessions are available. This affects the built-in RDP access method as well as RDP Proxy services.

Environment

CA Privileged Access Manager (PAM) integrated with RDP servers for access.

Cause

This is due to the definition of the RDP access or service in PAM.

Windows will allow as many connections as available from the License server for as long as they are regular sessions.

If the sessions are established as administrative sessions, then only two simultaneous sessions of this type are available. This is a Windows limitation, not a PAM limitation.

On the PAM side the type of the session is controlled by the "Console" checkbox when assigning the RDP access method to a device.

If an RDP Proxy service is defined on the Services > Manage TCP Services page (Manage TCP/UDP Services page prior to 4.3.2) invoking the native mstsc client, use of the "/admin" argument in the Client Application string has the same effect as checking the Console checkbox in the RDP access method.

Resolution

Remove the /admin switch from the RDP service definition, if accessing PAM via an RDP Proxy service, and/or uncheck the Console checkbox in the device editor in PAM, if accessing the RDP server using the RDP access method on the PAM Access page.

Additional Information

If some tasks require administrative RDP sessions, define a second RDP Proxy service that includes the "/admin" option for mstsc. Both services can be added to a single access policy for a PAM user or user group.