Error: PAM-CM-0575 Unauthorized script name when using PowerShell 7 with A2A

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When executing a PowerShell 7 script with script integrity validation enabled, the Privileged Access Manager (PAM) A2A client fails to retrieve credentials. The Account Requests report indicates that the script name is identified as `pwsh.exe` instead of the actual script filename (e.g., `ScriptName.ps1`). The script works as expected when using Powershell 5.1 (powershell.exe).

Environment

PAM A2A Clients 4.3.1 and below

Cause

There was an issue with the A2A code which caused it to incorrectly process the Powershell 7 exe and identify it as the script name. This results in an authorization failure because the mapping expects the script name, not the interpreter name.

Resolution

The issue will be fixed as DE678078 in the 4.3.2 A2A client, use Powershell 5.1 until it has been published.

Additional Information

When 4.3.2 is released, the new A2A client can be downloaded from the Privileged Access Manager Solutions & Patches page.

Subscribe to this article to be updated on fix status. Refer to the How to Subscribe to a Knowledge Document for more information.