[PAM] "Access is denied" in learn mode for RDP Transparent Login

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Remote Desktop Service is setup and CMD.EXE published as RDP Program as documented.

The application is accessible to all Domain users and it is also added to the Default Collection. 

However, when accessing the Windows system with the RDP applet from the appliance, with the Learning Mode checbox selected, the remote screen opens but after a few seconds the following screen is displayed

However, the user used to log in into the RDP device has the necessary rights to run any script

 

 

 

Environment

Release:
Component: CAPAMX

Cause

The Access Denied message may come from an incorrect parameter line for the published cmd.exe application when choosing the "Always use the following command line parameters" option. This may be caused by an incorrect pasting of the parameters in the line or by an error typing them in.

Common error is the "\\tsclient\virt\xcd_run.bat" need to be wrapped with double quote but as can be seen below the closing double quote may be missing.

/C title Initializing RDP session&echo Please wait...&timeout 4 /nobreak>nul&"\\tsclient\virt\xcd_run.bat

 

Resolution

 

Use the following.

/C title Initializing RDP session&echo Please wait...&timeout 4 /nobreak>nul&"\\tsclient\virt\xcd_run.bat"