Heartbeat/ Password rotation fails

Hi Devolutions-Forum,

I encountered the following problem:

• The accounts are all stored in the same OU in AD

• All accounts have "admin count" set to 1 (The object belongs (or belonged) to the protected objects; permission inheritance is disabled.)

• The Accounts are all members of the protected users group

• The Accounts are member of Domain Admins

• The PAM provider account has delegated rights (Least privileges for Active Directory providers | Devolutions PAM | Product guides & reference)

I managed to set up one account to work by adding the rights of the PAM provider account directly to it.

Then I tried to do the same on the next account, but it fails to rotate the password or heartbeat. -> Error LDAP 49.

Additionally, the values in domain, UPN, SAM account name and NetBIOS name are not populated in the not working PAM account.

Is there anything missing? Is it the right way to assign the rights directly on the user?

Best wishes