Support

Hello, I have troubles switching to a non-administrator account in a report script. The usage is simple, I connect with it to collect and list all entries of specific vaults. I dont want, however, this service account to access the passwords/secrets of the credentials entries. Only certain properties. Obviously administrator can, but whenever I change to a USER, even if I allow everything to it, script cannot make a connection. Is it possible to use low level access account for automated export purposes? Thanks!

Hi! We configured database retention to delete logs older than 1 year, but the logs still stay in the database. It has been like this through multiple DVLS updates with no change. We are currently on 2026.1.24.0. For some tables, we have entries from 2019. I have not clicked "Clean up now" yet, because I want to verify it works automatically. [image] I checked some of the "_Archive" tables, and none of them contain any entries. Scheduler service is installed and running. Automatic backups work. How to troubleshoot further? Thank you! Best regards, Daniel

Hello, After updating to DVLS 2025.3.7, RDP entries using domain user PAM credentials would no longer work because the correct domain attribute was not being passed to target host. It appeared that the currently logged in user's domain was being passed instead. Rolled back to 2025.2.x all the respective RDP entries started working again. Using RDM 2025.3.16 Wondering if this (or a similar) issue been reported elsewhere? Please let me know if you would like any additional info. Thanks Joe

Environment: - Devolutions Server container, devolutions/devolutions-server:release-2026.2 (client build 2026.2.15.0) - Primary node: Azure App Service for Linux Containers, Azure SQL Database backend, fronted by Azure Front Door (custom domain) - Planned second node: on-premises, same network as our Active Directory, connecting to the same Azure SQL database over a planned site-to-site VPN Goal: We need PAM features that depend on reachability to our on-prem Active Directory. Since the Azure-hosted node can't reach on-prem AD directly, our plan is to run a second DVLS Server instance on-prem pointed at the same Azure SQL database as the Azure node so the on-prem node handles AD-dependent PAM operations while the Azure node continues serving cloud/remote users, both against one shared vault. Questions: 1. Is running two DVLS Server instances concurrently (not active/passive failover — both actively serving traffic to different user populations) against the same database an officially supported topology? If not supported today, is there a recommended alternative for giving a cloud-hosted DVLS instance access to an on-prem AD for PAM without a second live node? 2. If concurrent nodes are supported: does each node require the identical encryption.config/DVLS_ENCRYPTION_CONFIG_B64 to correctly decrypt shared vault data, or is there a different mechanism for multi-node encryption key distribution? 3. We used Set-DPSAccessUri with -AdditionalAccessURIs to register a second valid external hostname against one database (needed to fix an OAuth/AccessUri mismatch behind Azure Front Door). Is this the correct/intended mechanism for a node serving multiple hostnames, or is it meant only for a single node with multiple front-end domains, not genuinely separate server instances? 4. Are there known constraints around session affinity, caching, or concurrent-write conflicts when two nodes serve live traffic against one database simultaneously? 5. Is there a licensing consideration for running multiple concurrent instances against a single license/database?

Hi Devolutions-Forum, is it possible to change the PAM settings without assigning a license to the administrator account? It is a bit inkonvenient to assign the license to the admin account for just setting up/ changing the PAM settings. Or is it by design? Best wishes,

Hello, We are using Remote Desktop Manager v 2025.2.14.0. I am working with some automations that leverage the API, and it appears as though the PATCH method does not work, despite receiving a HTTP 200 response back from the server. Specifically, I am trying to change some attributes on an existing entry in our vault. I am sending a PATCH to this endpoint: https://our-remote-desktop-manager.com/dps/api/v1/vault/{{vaultId}}/entry/{{entryId}} And, I'm sending the following raw payload with the PATCH request: {"name":"Test Device Name", "description" : "Test Description via API call"} I receive an HTTP 200 back from RDM.. but when I go and check the vault, nothing has changed. If I look at the History section of the device entry in the RDM web interface, I do see the change event in the history. Do you have any idea what the issue could be?

DVLS 2026.2.12.0 I've only recently starting to use DVLS directly for informal change logs. I've noticed that when viewing an entry, the panel does not fill completely. The red rectangle is not used. [image]

Hello Devolutions Team, I've observed a strange behaviour while using the password management with password-policies. Our setup: - Devolutions Server in the currently recent version: 2025.3.10.0 - RDM Remote Desktop Manager in the currently recent version: 2025.3.35.0 In the system configuration in the section password management, I've configured five password policies and definied one of them as default policy (enforce default policy is NOT activated). [image] In the Web-UI I have configured for the global vault itself the password management as "inherited". Here the configured default policy (FGPP-User) is correctly shown. [image] For a dedicated folder, I have overriden the default with the concrete "FGPP-Technical". But here the problem arose: when I create a new password entry and prepare a new password value using the password generator, the globally configured default policy "FGPP-User" is selected. The password mode "advanced" and the values for length etc. is properly filled, but the selectbox shows the wrong default policy instead of the defined overriden "FGPP-Technical". [image] So far for the WebUI. In the Remote Desktop Manager desktop application (Windows), I'm encountering a different behaviour: Also here the behaviour is wrong, but different. When creating a new password entry in the dedicated folder (with the oerriden default policy with the concrete "FGPP-Technical"), the correct policy is pre-selected, but the values are completely wrong. In the folder properties in password managenent for the dedicated folder (with the oerriden default policy with the concrete "FGPP-Technical"), the correct policy is pre-selected, but the values are completely wrong. [image] As you can see, the symbol characters is active with a minimum of two, which is not the configured setting for the FGPP-Technical. And when creating a new password using the generator, the selectbox shows "Entry's configured password policy", basically stating the for this entry an unnamed overriden policy is defined, but as previously stated I just selected the different pre-defined FGPP-Technical. Additionally the mode is defined as "Default", but should be "Advanced", the symbols definition is wrong and the exclude/include lists are missing/wrong. Nevertheless, the password length, description and expiration setting is correct according the defined "FGPP-Technical" definition. [image] Am I misinterpreting the intended behaviour or is this a bug ? Kind regards Alex

Are Host entries intended to act as permission inheritance parents for subentries (SSH, RDP, Website, etc.), or do subentries inherit permissions only from folders/vaults? In our testing, a subentry displays permissions as "Inherited" from its Host, but a user who has View/Connect permissions granted only on the Host still cannot see or access the subentry. Is this expected behavior or a bug?

When deleting entries, those can be restored. How about vaults? Is there any way to restore those? KR G.

When the Duo prompt is presented the SMS button does nothing. The application has SMS an an allowed method. Phone call and push are working. The behavior is not tied to a single user, computer, or browser. Any ideas? Thanks, GM

Hi I created a new Entra ID PAM vault with password rotation for accounts in Entra ID. Connection test and password rotation works as expected. In RDM I have an existing "Default" vault, where we configured all connections to our systems. I'm struggling using the newly created Entra ID PAM vault as linked vault in existing system connections, e.g RDP to a Windows Server or portal website of Entra ID. In "Default" vault I created already a Devolutions Server cross vault entry. In this Entry I can see my Entra ID PAM vault. If I try to use this credential to link it to a session, I cannot see/choose any Entra ID credentials from Entra ID PAM vault. Can you help me please? Br Walter

hi, we are using Entra Id groups and are adding them to our Devolutions Server as "User group". I noticed that when the Entra Id group name changed this is not reflected in the Devolutions Server unless the group is deleted and added (with the new name) again. Is there some way to update/synch the group name? KR G.

Hello, I am writing to request your assistance regarding an issue we encountered while upgrading our Devolutions Server (hosted via Docker with an MS SQL database). I recently attempted to upgrade our DVLS container directly from version 2025.3 to 2026.2.11. After starting the new container, we encountered the following database error: Invalid column name 'AccountExpirationDate' Additionally, as a result of this issue, all users were unexpectedly removed from their respective groups. It appears that there was a change in the database structure, but the schema migration did not execute properly. Could you please advise on how to proceed? To perform this upgrade correctly, is it necessary to upgrade step-by-step through all the intermediate versions, or should a direct upgrade handle the database migration automatically? Thank you in advance for your support. I look forward to your guidance.

I'm using Devolutions server release 2026.2.7.0 Schedule backup every day fail with message "Backup file not created" The true is that the sql backup file is presente on the selected folder but it is not zipped as expected from the backup task. When I execute the backupo task from the Bakup-manager web page within the server, the backup is done and zipped correctly. Only scheduled backup fails! Where is the problem?

Hello Devolutions community, yesterday i created three new users in DVLS and i discovered that my conditional access rule for enforcing 2FA stopped working. In the past new users got a prompt after the first login to configure 2FA, when the condition access rule got enforced. Currently i am using DVLS-Version 2026.2.9.0 and the mentioned prompt doesn`t show up and the user gets logged in instead. In my case its a domain user, but I also was able to reproduce the issue with an internal DVLS-user. Here are screenshots of the conditional access rule for enforcing 2FA and the 2FA settings on the DVLS. [image] [image] Unfortunally i cant remember the last time that mentioned prompt on first log was working, because i didn`t had to create new users for the past 6 months. As a workaround i manually enabled 2FA on each account. Please take a look at it let me know if this is a bug or a configuration error on my site. If you need further information let me know. Thanks in advance and best regards, Markus

Hi Devolutions-Forum, while rolling out DVLS/ DPM/ DRM I came across this GUI inconsistency in the edit/ new entry window DPM: [image] DVLS: [image] RDM: [image] In RDM it is okay but in DVLS and DPM it is a bit confusing. Best wishes

Hi everyone, I think I've found a bug or an error. Or maybe I just didn't notice the changes. The day before yesterday, we updated the Devolutions servers from 2026.1.15 to 2026.2.7.0. Today I noticed that the permission sets I defined are missing. They aren’t displayed in the WebUI and can’t be selected in RDM. But I know they’re being applied because I have a clone of “Contributor (Default)” where I simply removed the “Delete” permission. All permissions are still as they should be, and “Delete” is still prohibited everywhere. This issue occurs in versions 2026.2.7.0 and 2026.2.9.0. 2025.1.15.0 [image] 2026.2.9.0 [image] Thanks und best regards Alex

Hey, when i try to send a password via Devolutions Send within RDM, the password does not appear in the secure message field. It works fine in the Devolutions Server Website and in RDM with a local database but not with the DVLS datasource. RDM Version: 2026.2.11.0 Best Regards, Fabian

I have a vault with some certificate entries. I have added the certificate file and to save the keystore passphrase I used the Smart Card PIN field. Now I cannot get back the PIN, neither using clipboard function nor editing the entry. What am I doing wrong?

Hello Devolutions Support Team, I am testing Devolutions Server PAM in a lab environment and I am having an issue with permissions. I created a new normal domain user and added him to Devolutions Server as a regular user, not an administrator. Then, when I log into Remote Desktop Manager with this user, he already has many permissions on a PAM vault/entry even though I did not explicitly give him those permissions. For example, in “My permissions” for the PAM entry, the user appears to have permissions such as edit, delete, view password, reset password, approve checkout request, force check-in, and grant checkout. What I want is simple: Technician user: only view/use the entry and request checkout. Approver user: approve checkout requests. Admin user: full control. Could you please help me understand where these permissions are coming from and how I can remove the inherited/default permissions so the technician user only has the minimum required access? Thank you.

Hello, we are having issues when we try to configure email sending with a postfix email relay. This is the detailed report created with Devolutions Server 202.1.16.0: ================================================================================ BUG REPORT — DEVOLUTIONS SERVER FREE 2026.1.16.0 SMTP / TLS — SSL ALERT 42 (bad_certificate) AFTER SUCCESSFUL TLS HANDSHAKE ================================================================================ Date: 2026-05-21 Reported by: Alessio Gennari — Senior Systems Engineer, Trigano Servizi S.r.l. Product: Devolutions Server Free 2026.1.16.0 Component: Administration > Server Settings > Email (SMTP client) Severity: Critical — email functionality completely non-functional -------------------------------------------------------------------------------- 1. ENVIRONMENT -------------------------------------------------------------------------------- Devolutions Server host: Hostname : TGRP-SRVDVLS.domain.local IP address : X.X.200.57 OS : Windows Server 2019 Domain : domain.local (Active Directory domain-joined) SMTP relay host: Hostname : testsmtp.domain.local IP address : X.X.201.162 OS : Debian GNU/Linux 12 MTA : Postfix 3.7.x Port : 587 (submission / STARTTLS) Devolutions SMTP configuration (Administration > Server Settings > Email): Host : testsmtp.domain.local Port : 587 Username : devolution Password : (configured) Connection security: Automatic based on port number Send email as : devolution@trigano.it -------------------------------------------------------------------------------- 2. CERTIFICATE DETAILS -------------------------------------------------------------------------------- The SMTP relay presents an X.509 certificate issued by an internal Active Directory Certificate Services Enterprise CA (caravansinternational-CA). Subject CN : testsmtp.domain.local Issuer : caravansinternational-CA SANs : DNS:testsmtp.domain.local, DNS:testsmtp, IP:X.X.201.162 Key usage : Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment EKU : TLS Web Server Authentication (1.3.6.1.5.5.7.3.1) Valid from : 2026-05-21 Valid to : 2036-05-18 Key size : RSA 4096-bit The issuing CA certificate is automatically deployed to all domain-joined machines via Group Policy (Trusted Root Certification Authorities store). TGRP-SRVDVLS is domain-joined and has the CA in its trusted root store. -------------------------------------------------------------------------------- 3. OBSERVED BEHAVIOR -------------------------------------------------------------------------------- When Devolutions Server attempts to send email via the configured SMTP relay, the connection always fails with: "Error sending email — Unexpected exception. Please see server logs for details." The Postfix server logs show the following sequence on every attempt: 1. TCP connection established from X.X.200.57:ephemeral to X.X.201.162:587 2. EHLO command sent by Devolutions — acknowledged by Postfix 3. STARTTLS command sent by Devolutions — acknowledged by Postfix ("220 Ready") 4. Full TLS 1.2 handshake completes successfully (Postfix logs: "Anonymous TLS connection established ... TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)") 5. Immediately after the handshake, Devolutions sends TLS alert 42 (fatal: bad_certificate) WITHOUT reading any post-STARTTLS SMTP data 6. Connection is dropped Postfix log excerpt (representative, from a clean full handshake): postfix/submission/smtpd[12109]: connect from TGRP-SRVDVLS...[X.X.200.57] postfix/submission/smtpd[12109]: SSL_accept:SSLv3/TLS write certificate postfix/submission/smtpd[12109]: SSL_accept:SSLv3/TLS write key exchange postfix/submission/smtpd[12109]: SSL_accept:SSLv3/TLS write server done postfix/submission/smtpd[12109]: SSL_accept:SSLv3/TLS read client key exchange postfix/submission/smtpd[12109]: SSL_accept:SSLv3/TLS read change cipher spec postfix/submission/smtpd[12109]: SSL_accept:SSLv3/TLS read finished postfix/submission/smtpd[12109]: Issuing session ticket, key expiration: ... postfix/submission/smtpd[12109]: SSL_accept:SSLv3/TLS write finished postfix/submission/smtpd[12109]: Anonymous TLS connection established from tgrp-srvdvls.domain.local[X.X.200.57]: TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits) postfix/submission/smtpd[12109]: SSL3 alert read:fatal:bad certificate postfix/submission/smtpd[12109]: warning: TLS library problem: error:0A000412:SSL routines::sslv3 alert bad certificate: ../ssl/record/rec_layer_s3.c:1601:SSL alert number 42: postfix/submission/smtpd[12109]: lost connection after STARTTLS from TGRP-SRVDVLS.domain.local[X.X.200.57] postfix/submission/smtpd[12109]: disconnect from TGRP-SRVDVLS...[X.X.200.57] ehlo=1 starttls=1 commands=2 Note: "commands=2" confirms only EHLO and STARTTLS were sent — Devolutions aborts before sending any SMTP commands after TLS is established. -------------------------------------------------------------------------------- 4. PROOF THAT THE ISSUE IS NOT A CERTIFICATE TRUST PROBLEM -------------------------------------------------------------------------------- A PowerShell SslStream test was executed directly on TGRP-SRVDVLS to verify whether Windows SChannel trusts the server certificate. The test manually performed the SMTP STARTTLS upgrade and authenticated via SslStream with the same hostname Devolutions uses. PowerShell script executed on TGRP-SRVDVLS: $tcp = New-Object System.Net.Sockets.TcpClient("testsmtp.domain.local", 587) $stream = $tcp.GetStream() # [EHLO / STARTTLS exchange omitted for brevity] $ssl = New-Object System.Net.Security.SslStream($stream, $false, { ... return $true }) $ssl.AuthenticateAsClient("testsmtp.domain.local") Result: Certificate errors : None Cert subject : CN=testsmtp.domain.local, ... TLS OK : Tls12 / Aes256 Windows SChannel successfully validates the certificate with zero errors. The CA is trusted, the hostname matches the SAN, and TLS 1.2 negotiates correctly. This conclusively rules out any certificate trust issue on the Windows side. -------------------------------------------------------------------------------- 5. WHAT HAS BEEN RULED OUT -------------------------------------------------------------------------------- The following have been investigated and eliminated as root causes: - Certificate not trusted by Windows : RULED OUT (see Section 4) - Certificate chain incomplete : RULED OUT (chain verified OK by both openssl and SChannel) - Hostname mismatch (SAN) : RULED OUT (SAN contains the exact hostname Devolutions uses) - TLS version mismatch : RULED OUT (TLS 1.2 negotiated successfully by both sides) - TLS downgrade sentinel (DOWNGRD) : RULED OUT (TLS 1.3 disabled on submission port; no sentinel present in server hello) - Postfix requesting client certificate : RULED OUT (no smtpd_tls_req_ccert or smtpd_tls_ask_ccert configured; Postfix logs show "Anonymous TLS") - SASL user missing : RULED OUT (devolution user added to sasldb after investigation; failure unchanged) - IP not in mynetworks : RULED OUT (X.X.200.57 added; failure unchanged) - AUTH advertised before STARTTLS : RULED OUT (smtpd_sasl_auth_enable disabled globally, enabled only in submission override; failure unchanged) - Postfix misconfiguration : RULED OUT (identical Postfix setup works correctly with other SMTP clients on the same network) -------------------------------------------------------------------------------- 6. ROOT CAUSE ASSESSMENT -------------------------------------------------------------------------------- The evidence indicates a bug in Devolutions Server's SMTP client implementation. After a fully successful TLS 1.2 handshake (confirmed by both Postfix logs and independent SChannel verification), Devolutions sends TLS alert 42 (bad_certificate) to the server without reading any post-STARTTLS SMTP response. Alert 42 (bad_certificate) in this context is being generated by Devolutions' application-layer SMTP/TLS code, not by Windows SChannel — SChannel itself reports no errors when performing the identical handshake independently. The pattern suggests that Devolutions' SMTP client performs an additional certificate validation step after the TLS handshake (possibly using a different certificate store, trust policy, or validation API than SslStream) and aborts when that secondary check fails, before the application has read any data. Possible areas to investigate in the Devolutions codebase: - Custom certificate validation callback rejecting the cert despite SChannel accepting it - Use of a different trust store or certificate pinning mechanism - An exception thrown during post-handshake processing that causes the connection to be closed with alert 42 rather than a clean error - Difference in behavior between .NET SslStream and the SMTP client library Devolutions uses internally (e.g. MailKit, SmtpClient, or custom) -------------------------------------------------------------------------------- 7. SUGGESTED DIAGNOSTIC STEPS FOR DEVOLUTIONS TEAM -------------------------------------------------------------------------------- 1. Enable verbose SMTP/TLS logging in Devolutions Server and capture the full exception stack trace at the point where alert 42 is sent. 2. Identify which certificate validation API is used in the SMTP client (e.g. RemoteCertificateValidationCallback, X509Chain.Build, etc.) and compare its behavior against SslStream with the same certificate. 3. Test against an SMTP relay using a publicly trusted certificate (e.g. Let's Encrypt) to determine if the issue is specific to internal/private CA certificates. 4. Test with Connection Security set to "No encryption" to confirm the SMTP client itself functions correctly when TLS is not involved. 5. Test with Connection Security set to "Use SSL or TLS immediately (SMTPS)" on port 465 to determine if implicit TLS (no STARTTLS negotiation) works where STARTTLS does not. -------------------------------------------------------------------------------- 8. CONTACT -------------------------------------------------------------------------------- Reported by : Alessio Gennari ================================================================================ END OF REPORT ================================================================================ Anyway there is the same error also with version 2026.2.4.0 just installed. Can you please help us? Very kind regards. Alessio

We are using Devolutions Server v2025.3.19.0 and are experiencing the following issue. It has already happened three times this month that suddenly no login with a domain user was possible. The Devolutions Server is a member of Domain A. The user accounts are located in Domain B. When the problem occurs, we observe that the LDAP account configured on the Devolutions Server (Administration > Server settings > Authentication > Domains) for the domain suddenly authenticates against Domain A instead of Domain B. We can clearly identify this because we see audit failure events (Event ID 4625) for the ldap account on the domain controllers in Domain A. This state persists until we restart the server. When the issue occurs, it always happens at the same time of day. In the Windows Event Log, we consistently see the following events. It is clear that these events can trigger this issue: (These events occur daily but do not always lead to the problem.) [image] [image] [image] [image] [image] Is this behavior a known issue? Are there any configuration options to resolve this problem?

Hi there, I want to create a fully automated workflow using Devolutions RDM using the PowerShell module. This workflow will use the entry ID as input. This same workflow will be also implemented within the same data source but on a different vault. My question is, is the Entry ID field unique on the data source level or on the vault level? I know, the field is 16 bytes long field and getting the same two IDs is very unlikely, but I want to make sure to eliminate this risk completely by understanding the uniqueness of the Entry ID within a data source. Thanks!

Hello, I am currently migrating automation scripts from Remote Desktop Manager PowerShell to Devolutions.PowerShell for DVLS. I managed to create SSH and Web entries using New-DSEntryBase. Now, I am trying to automatically create FileZilla SFTP entries using New-DSEntryBase. I successfully create the entry in DVLS, but when opening it from the Web UI or from RDM app, the entry is incomplete. There is no host, no username, no password... What I already tested: Creating entries manually in DVLS Exporting existing entries using Get-DSEntry Rebuilding the JSON payload manually Using: connectionType = "FTP" or "9" connectionSubType = "FileZilla" protocol/host/port/username/password fields Cloning existing entries However, exported FileZilla entries seem incomplete: host is missing username is missing provider-specific settings are not visible only minimal data is returned I also tried using New-DSEntryBase -FromRDMConnection and integrate the input configuration that is used in my functional RDM PowerShell script but it fails because the cmdlet expects: Devolutions.RemoteDesktopManager.Business.Entities.ConnectionInfoEntity while New-RDMSession returns: RemoteDesktopManager.PowerShellModule.PSOutputObject.PSConnection My goal is to fully automate the creation of FileZilla SFTP entries in DVLS from PowerShell. Could you please provide: The correct JSON schema for FileZilla SFTP entries The required connectionType / connectionSubType values The recommended way to automate FileZilla entry creation in DVLS Whether some provider-specific data is intentionally hidden from Get-DSEntry Thank you. Here is my non-functional JSON configuration : $body = @{ name = "SFTP - Test 01" group = "FOLDER01" vaultID = "00000000-0000-0000-0000-000000000000" connectionType = "9" data = @{ host = "10.1.1.1" username = "sftpuser" protocol = 1 passwordItem = @{ sensitiveData = "MyPassword123!" } } }