User gets vault permissions automatically in RDM
Hello Devolutions Support Team,
I am testing Devolutions Server PAM in a lab environment and I am having an issue with permissions.
I created a new normal domain user and added him to Devolutions Server as a regular user, not an administrator. Then, when I log into Remote Desktop Manager with this user, he already has many permissions on a PAM vault/entry even though I did not explicitly give him those permissions.
For example, in “My permissions” for the PAM entry, the user appears to have permissions such as edit, delete, view password, reset password, approve checkout request, force check-in, and grant checkout.
What I want is simple:
- Technician user: only view/use the entry and request checkout.
- Approver user: approve checkout requests.
- Admin user: full control.
Could you please help me understand where these permissions are coming from and how I can remove the inherited/default permissions so the technician user only has the minimum required access?
Thank you.
All Comments (1)
Hello,
Those permissions are not granted to the user directly. They come from the permissions on the PAM vault itself, which apply to everyone who has access to it. In a PAM vault, the operations reset password, approve checkout request, force check-in, checkout, and read logs each have a setting that can either allow every user or be restricted to specific users (Custom). In your case these are currently allowing all users, which is why your new user has them. The view, edit, delete, and view password permissions come from the permission set granted on the vault to users who have access. So the user is inheriting the vault's permissions, not getting an explicit grant on their account.
To get to least privilege, restrict these and assign permissions per role:
- Open your PAM vault and go to its Default permissions. For the PAM operations (reset password, approve checkout request, force check-in, checkout, read logs), set each to Custom instead of allowing every user, and grant each only to the users or roles that need it.
- Set the vault or folder permissions explicitly under Properties, Security, Permissions, granting access per user or group rather than relying on broad defaults.
- For the technician, grant only the minimum needed to view and use an entry, which is View vault, Connect (Execute), View password, and View sensitive (the Privileged operator permission set), plus the Checkout permission so they can request checkout. Do not grant edit, delete, approve checkout, force check-in, or grant checkout.
- For the approver, grant only Approve checkout request.
- For the admin, grant full control.
After this, reopen My permissions on the entry with the technician user and you should see only view, use, and request checkout. The permission model is documented here: https://docs.devolutions.net/pam/server/roles-permissions/
Best regards,
Michel Audi
