RDP Proxy Auto-Login Fails with Logon Failure 0xC000006D Due to Empty Domain Injection

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Users are unable to launch RDP sessions via the RDP Proxy for specific privileged accounts or target servers. While some accounts may work normally, others consistently fail during the "automatic login" phase.

Specific Error: The Windows target server reports: NTSTATUS: STATUS_LOGON_FAILURE [0xC000006D] or Substatus: 0xC0000064 (User not found)

Cause

A software defect in the PAM PHP backend prevents the system from correctly retrieving the domain name from the target application metadata before passing it to the RDP Proxy. Because the domain name is passed as an empty string, the target Windows server attempts to authenticate the user as a local account rather than a domain account, leading to the logon failure.

Resolution

This issue is formally resolved in PAM 4.2.2 (tracked under defect DE621274 and DE674134) and all subsequent versions.

Recommended Action: Upgrade the PAM appliance to version 4.2.2 or higher.