Windows Proxy release to PAM release mapping
Article ID: 388995
Updated On:
Products
Issue/Introduction
The Windows Proxy uses release numbers different from the PAM release the proxy is published with. E.g. the Windows Proxy downloaded from Product Downloads for PAM 4.2 has version 4.21.0.92. Why is it different?
Cause
The Windows Proxy is a Credential Management component that initially was used by an independent product called Password Authority (PA). This product was merged with a device access management product to create a privileged access management product, now called PAM. At the time the products were merged, PA was on a 4.X release. A general rule of management products with agents is that a newer manager supports older agents, but not the other way round. The Credential Manager server in PAM checks the version of any Windows Proxy server that tries to connect to it, and rejects any request coming from a Proxy version higher than the server version. In order to allow the new PAM product to work with existing older Windows Proxy servers, it had been decided back then to continue the Credential Manager release versioning that had been used for PA, rather than setting it back to 1.0, the first PAM version. For the most part this is an internal version. But it is visible as Windows Proxy version.
Resolution
The following table maps the Windows Proxy releases to the PAM server releases. Note that full version strings shown in the PAM UI typically include a build number that is appended to the release version string. These build numbers are not used in version checks and are not included in the table, because there is no 1:1 relationship between PAM build number and Proxy build number, see the additional information below.
| PAM version | Windows Proxy version |
| 3.4.X | 4.18.X |
| 4.0.X | 4.19.X |
| 4.1.X | 4.20.X |
| 4.2.X | 4.21.X |
X represents the maintenance release. E.g. the 4.2.1 PAM maintenance release includes the 4.21.1 Windows Proxy release.
Additional Information
The full version strings for a PAM release include a build number that is appended to the release version string, such as 4.2.0.826 for the PAM 4.2.0 release. This just says that the 4.2.0 release was built 826 times before it reached the GA build. The Windows Proxy would only get rebuilt for changes in its source code. Thus it will have a different build number, such as 4.21.0.92 for PAM 4.2.0.
Hotfixes for PAM only update a small subset of files and they typically do NOT change the version you see at the bottom of the PAM client UI page. Hotfixes for Windows Proxies on the other hand typically include a full rebuild of the Proxy and therefore do include a new build number.
The A2A client is another Credential Manager client with its own release. Unlikely the Windows Proxy, the A2A release has not changed in years. All current PAM releases, as of February 2025, include different builds of the same A2A version 4.12.3, which was the Credential Manager version for the PAM 2.8.3 release. This may change in a future release, if the A2A client needs to be changed in a way that makes it incompatible with older PAM versions. Until that time every new A2A client release will be compatible with all supported PAM releases.
Feedback
