Support

Hey, when I check out my PAM Admin and save the password to yubikey it gets saved in the wrong keyboard layout. I have a german layout but it gets saved in american. For example my password is: züöä!?+#-_.:,; but on yubikey will be saved as: y[;'!_]\/?.>,< The current workaround is to change the windows keyboard layout to american. Is there a way to change the keyboard layout settings?

Hi everyone... As a hosting provider, we provide all the infrastructure our customers need to host their applications. These customers have several contractors who support the applications running on our infrastructure. That's why, at my company, check out processes is never performed by the contractors: after our customer provides us the proper authorization, we proceed granting check out for the contractors... Given this scenario, we have two different types of account: the fixed ones: each customer have, by right, 3 domain accounts to be used by these contractors. the temp ones: there are special occasions when same customers need more than 3 accounts, so, we create 'temp' ones. NOTE: All these contractors access our environment through a Windows TS Server. So, I'm trying to setup Devolutions PAM solution to help us automate and audit all the external access from those two scenarios. The first one is already mapped out and working like a charm: we've set up a provider and saved the accounts to a PAM Vault. Once in this case the check-in process do NOT terminate the account, we can access the TS by checking out the privilege account to ourselves , log in the TS using the privilege credentials, set some things up in the session according to the customer we're dealing with, and check in the privilege account when done. After that, we grant checkout to the contractor and the process is finished. The second one is giving me headache. We reaaaaaly could use the benefits of JIT Accounts, because the account is created using RDM directly and is terminated automatically. The problem in this process is that I (as administrator) cannot view the password created for these types of users (when checked out) so I could log in the TS to setup it's session (only if I check out, but when I check in, the account is terminated and all I did in this session will be lost). If I could only view the password, all my problems would be solved (at least as far as I got so far... lol): [image] [image] If, by design, this possibility violates some major PAM principle and will not be considered at all... can you tell me if there's a way to accomplish our needs regarding the second scenario (without considering the possibility of creating these accounts manually in the DC, as we do nowadays)? Sorry about the gigantic post... :) Looking forward to hearing from you soon. Regards, Elaine Berenguer

Hi! I have a situation here at my company that all JIT accounts must always have a default set of privileges and a special individual one, which will determine which customer of ours they will access (we have a bunch of specific configurations that depends on which customer he will support). However, when I'll set the privileges when granting checkout, as you can see bellow, only the permission sets are available to select, but the other ones aren't (CCA, FOR or MAT)... [image] [image] Can you please tell me if there is some configuration I'm missing to make them both available (the privilege set and the individual provider privileges) to be selected? If there's not, I believe it would be a great feature... PS.: While I was writing here for you guys, I did another test creating another Privilege Set using one of the others provider privilege we have and now it's available... That means that when you enable privilege set, only them will be available, right?I believe it's too much work, since we have more than 85 different customers and we already have to pinpoint each group in provider... :P [image] [image] Thank you! Regards, Elaine Berenguer

I'm doing a Devolution PAM solution and set everything up. Created a PAM Vault with a privileged account entry and a RDP session and configured this last one to ask for a credential available in this very vault. Created a contractor account, gave him the proper permissions and accessed DVLS Web with this contractor account... When I try to connect to the RDP session using Launcher and choose the privileged account I get this error: "The workspace does not support the use of privileged accounts" . I couldn't find any thread in this Forum or in the Documentatiin about this error... The workspace in a Devolution Server one and I have a PAM license in place. The connection is being made through Devolutions Gateway. NOTE: The contractor was 'granted' with a RAM license. Am I doing something wrong? Can you help me? Att., Elaine

I am now experiencing password rotation and heartbeat failures on accounts in the Protected Users group after upgrading to DVLS version 2025.3.3.0. Once I remove the accounts from the group, everything works as expected. It appears that DVLS is using NTLM authentication instead of Kerberos. I get the following audit log in the domain controller when the user is in the Protected Users group at the time of rotation & heartbeat: NTLM authentication failed because the account was a member of the Protected User group. Account Name: [Redated Account Name] Device Name: [Redacted Domain Controller Name] Error Code: 0xC000006E In DVLS, I am getting an LDAP Code 49 failure when attempting the heartbeat or password rotation. Interestingly enough, password rotation & heartbeats work for members of the Protected Users group if the provider is set to use LDAP instead of LDAPS account, which isn't ideal. I am happy to provide more logs if needed, but not really sure where to go from here.

Posting on behalf of peterkalberer: Ist es möglich, Passwörter aus dem Active Directory in einen Tresor mit Benutzeranmeldedaten bidirektional zu synchronisieren? Weil wenn User ihre Passwörter ändern, würden diese im Tresor angeglichen. Best regards

In Devolutions Server version 2026.2 there is an option added to give default JIT provileges when checking out. Where can I find this option to configure? I can't find this is the PAM section of Devolutions Server.

We use password rotation within the PAM module where we configure to reset the password for our privileged accounts on a daily base. This is configured to reset every day at 05:00 a.m. but Devolutions is resetting this at 07:00 a.m. Is this a known issue and can this be fixed?

Hello. Is it possible to do propagation scripts over Devolutions Gateway? I can't seem to find any way to configure it, and as i understand it, the actual scripts are running from the Devolutions Server? So the Propagation Scripts require line of sight to the servers it should run on, if the propagation script requires remote configuration to be set on remote computers? Br, Tony

Hi there, I don’t understand how the Devolutions PAM works, or I might be missing something. For me, PAM involves several actions: Rotating passwords Protocol break between client/server (for example, no direct access to the RDP port) Recording sessions as video Allowing privileged sessions with a workflow/approval system Potentially being able to block certain actions or commands on systems Which of these actions are handled by Devolutions? I believe that for points 2 and 3, it is necessary to go through Devolutions Gateway. Is that correct? My usage is internal only. I mainly want to use PAM for actions 1 to 3 for the IT Admin team. What I don’t understand now is how to import PAM accounts for individual use. Let me explain : In my Active Directory, I have T0 and T1 OUs (for a tiering model). In T0 and T1, I have admin accounts (e.g., t0.jdoe, t0.bdupont, t1.jdoe, t1.bdupont ). These are the privileged accounts. On the Devolution Server, I therefore have a user John Doe and a user Bernard Dupont. On RDM, each of them has T0 resources (AD VMs, routers, etc.) and T1 resources (business VMs, switches, etc.). How can I ensure that John Doe can only use his own accounts (t0.jdoe on T0 ressources and t1.jdoe on T1 ressources) and not Bernard Dupont’s accounts? At the moment, he can see all of them. Jerome

Hello! As soon as I check in to PAM via Devolutions Workspace on my smartphone, I receive the following error message by email: Error: ArgumentNullException - Value cannot be null. (Parameter 'g') at System.ArgumentNullException.Throw(String paramName) at System.Guid..ctor(String g) at Devolutions.Server.Controllers.APIControllers.V2.AttachmentController.GetPrivateAttachments(AttachmentFilter filter) at lambda_method1741(Closure, Object, Object[]) at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.SyncObjectResultExecutor.Execute(ActionContext actionContext, IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeActionMethodAsync() at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeNextActionFilterAsync() --- End of stack trace from previous location --- at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted) at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync() --- End of stack trace from previous location --- at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextExceptionFilterAsync>g__Awaited|26_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted) --- Default Source: System.Private.CoreLib In general, it takes some time for accounts to be upgraded before the changes actually take effect, even if the browser is refreshed or restarted. Concerning Microsoft Entra ID, DVLS 2025.3.14.0

Hello, we are currently experiencing significant issues with RDM and hope that you can assist us. When connecting a session with PAM credentials, the checkout dialog with JIT group appears, but shortly thereafter we receive a message that the account is already checked out. Prior to this connection attempt, the user was checked in. And even if it was checked out, the connection could be established directly without the checkout dialog. A few points at a glance: - Current versions: RDM 2025.3.29.0 / DVLS 2025.3.14.0. The problem has only existed since 2025.3.x, but it is unclear exactly since which version, approx. 8 weeks. - All users use the same RDM version, some locally, some via RDS. - The problem occurs with different PAM providers, but not always and not with all users. - When connecting to a session, the PAM checkout dialog appears immediately, but then it takes a long time to establish the session, up to 17 seconds, even for successful logins without error messages. - Logins are fast with non-PAM credentials. - Manual checkout of accounts (in the PAM vault) also takes a long time. - From time to time, employees lose their user-specific settings, and all stored credentials are then gone, leaving the list empty. This also affects some users more often than others. Thank you and kind regards, Simone

We've trialling the PAM system at the moment, and I'm having problems with the scans - they don't seem to return any users at all. The following are in place: A provider setup (for our Active Directory) and the connection test passes A scan configuration, for an OU in that directory that contains users If I run the scan (or wait for it to run as scheduled) I don't get any results.

Is it possible to perform any mass configuration (in particular setting of permissions) of accounts held in the same folder of the same PAM vault? Or is it only possible by means of inheritance or setting permissions on an account by account basis? We have an L1 folder containing, for example, the accounts serviceA_01, serviceB_01, serviceC_01, serviceA_02, serviceB_02, serviceC_02. We want to grant L1_user_01 access to all of the *_01 accounts in the L1 folder and grant L1_user_02 access to all of the *_02 accounts in the L1 folder. Is this possible as some kind of mass action (select accounts and assign permissions)?

We have installed the on-premise trial version of Devolutions Server using the " Privileged access management package " 5-user license provided. [image] However, when logged in as the administrator (dvls-admin) we are unable to see a " Privileged Access " item on the " Administration " page [image] or on the " Administration > Server Settings " page. [image] We are therefore unable to configure any Providers and consequently cannot trial the PAM component functionality.

Last week week updated to 2025.3.x and I set the Reason mode to Mandatory on JIT elevation only but this is not working. I can request JIT Elevation right without filling in a reason. Is this a known issue?

Hello, I tried to create a Domain Provider for the first time to connect to Active Directory, but I received an error: “Could not reach: undefined.” This occurs both in RDM and in the Hub Portal. I am not sure if I am missing something. I tested both LDAP and LDAPS and verified the domain name and credentials. The same credentials work successfully with the Active Directory dashboard entry. [image]

Hi, We have two issues after the updates from RDM 2025.2.30.0 to 2025.3.20.0 and DVLS 2025.2.14.0 to 2025.3.4.0. - Our PAM vaults disappeared from RDM (client installation). I found this comment in your blog post: "PAM vaults now appear alongside standard vaults in a single selector, eliminating the need to switch between views." Can you please provide a screenshot where to find the PAM vaults, we couldn't find it anymore ;-) Thanks. - With the new DVLS version but the old RDM version we are still able to see the PAM vaults but after the first PAM synchronization (from scan configurations) all the account display names in the PAM vaults are set to the SAM account names. We have renamed the accounts so that we can see at a glance which customer or domain the user belongs to. With the new Devolutions server version, the display names have been reset to the SAM account names, and even in the dashboard, the associated domains are no longer visible. This makes it impossible to identify which account it is. Thank you for your help and kind regards, Simone

Hello, When creating a new PAM standalone type entry in DVLS 2023.2.10 WebUI, there is an option to use the password generator, however this doesn't list, default to, or enforce the default password template that is defined in Administration\System Settings\Password Management. Please let me know if you would like any additional information. Thanks Joe

Hello, How does one unlock or force a check in of a locked Domain User PAM account in a Hub datasource? I have one account that wont check in using RDM, and in the web UI (while logged in as an administrator) there is no force check in or unlock options displayed. In RDM 2025.3.20 it also displays a red banner saying 'The credential has been locked due to the inability to revoke privileged rights during check-in.' Please let me know if you would like any additional info. Thanks Joe [image] [image] [image] [image]

Hello, When attempting to create a domain user type provider in hub business that uses a gateway, it fails on the 'test connection' with error 'Can't connect to provider. LDAP connection failed to dc.domain.local. LDAP result code 1002. Using Gateway 2025.3.2 installed on a domain joined Windows 2022 host, and PAM service executable v2025.3.1. There doesnt appear to be anything logged in the windows event logs, or gateway log files when the test connection is initiated. Please let me know if you would like more info. Thanks Joe

Hello, When using hub with PAM entitlement, a dedicated vault is required for storing the managed credentials, which cannot contain regular connection type entries. When creating a connection entry in a regular vault, there is no option to set the credential to 'privilege account' like would be done with DVLS. Instead I assume the expected approach is to choose 'Linked (external vault)', then choose the dedicated PAM vault and subsequently a specific credential entry. However, when using RDM 2025.3.20 there are no credentials populated in the dropdown after choosing the linked external vault which contains the PAM entries. Also, if it is left as the default of 'prompt on connection', upon launching the connection there are no PAM entries displayed for the user to choose. I tried attempting to do the same thing with Hub web ui but the PAM vault does not show up in the list of linked external vaults. How does one utilize a PAM entry as the credential for a regular connection entry with Hub? Not really sure if this a PAM, Hub or RDM issue/limitation? Please let me know if you would like any additional info. Thanks Joe

After updating Devolutions Server from 2025.1.x to 2025.2.4.0 password rotation is not working anymore for accounts in our PAM vault. Is this a known issue and can this be fixed as soon as possible?

Hello, We would like to import our passwords into a PAM vault. Since there are well over 100 of them, they are stored as a .csv file. Is there a way to import them so that they end up directly in a PAM vault?

I would like to set up temporary access. To do this, I have set the vault to shared and activated temporary access in the entire vault. I myself only have “view” rights to the vault. The vault is displayed to me in RDM and the relevant entries are also displayed. However, I have no way of requesting temporary access in RDM? I only see this option in the WEB Gui, which nobody works with. Please tell me that I have done something wrong. [image] [image]