PAM Client on macOS Fails to Establish RDP Sessions Without Autologin

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When using the PAM Client on macOS to establish an RDP session to a Windows Desktop, the connection fails if an account for autologin is not provided in the RDP service configuration. This issue prevents users from initiating RDP sessions through PAM without pre-configured autologin credentials.

Symptoms of this issue include:
- The RDP session fails to connect from the PAM Client on macOS when the "Application Protocol" is set to RDP and no autologin account is provided.
- A "0x204 popup error" is displayed to the user.
- A connection is successful if the "Application Protocol" is disabled.

Environment

PAM Client versions 4.2.0 to 4.2.3
OS: macOS Sequoia version 15.5

Cause

When auto login is disabled, it runs an additional code to retrieve the client PID of the Windows App application but fails to do so. The code execution terminates and the Windows App is unable to connect to the local RDP service. The code to retrieve the client PID is not correct and is the root cause for this defect.

Resolution

The issue is resolved by a fix included in PAM 4.3.0

This fix is listed on the Resolved Issues in 4.3.0  page.

Additional Information

Workaround Discovery: Disabling the "Application Protocol" in the PAM RDP service allowed successful connection, indicating the issue was specific to the RDP application protocol handling.