# ManageEngine® PAM360 FAQ

## General

### 1. Do I need to install any prerequisite software before using PAM360?

Apart from the standard system requirements (both hardware and software), the following elements are essential for the proper functioning of the PAM360 server.

These are especially required if you are planning to make use of PAM360's account discovery and password reset provisions.

- An external mail server (SMTP server) for the functioning of the PAM360 server and to send various notifications to users.
- A service account or a gMSA that has either domain admin rights or local admin rights in the PAM360 server and in the target systems that you would like to manage.
- Visual C++ Redistributable for Visual Studio 2015 and above, for PAM360's Account Discovery and Password Reset features.
- Microsoft .NET Framework 4.5.2 or above must be installed in the server where PAM360 is installed.

To check whether these software requirements are configured:

1. Go to **Support** > **Software Requirements**.
2. Click **Check Configuration**.

The configuration status will be displayed in the pop-up box.

### 2. What are the operating systems supported by PAM360?

PAM360 supports the following Windows and Linux operating systems:

| Windows | Linux |
|---|---|
| Windows Server 2019 | Ubuntu 9.x and above |
| Windows Server 2016 | CentOS 4.4 and above |
| Windows Server 2012 R2 | Red Hat Linux 9.0 |
| Windows Server 2012 | Red Hat Enterprise Linux 7.x |
| Windows 10 | Red Hat Enterprise Linux 6.x |
| Windows 8 | Red Hat Enterprise Linux 5.x |

### 3. Can others see the resources added by me?

Except for super administrators, if configured in your PAM360 setup, no one—including admin users—will be able to see the resources added by you. However, if you [share your resources](https://www.manageengine.com/privileged-access-management/help/sharing_resources.html) with other administrators, they will be able to see them.

### 4. Can I add my own attributes to PAM360 resources?

Yes. You can extend the attributes of the PAM360 resource and user account to include details specific to your needs. Refer to [this document](https://www.manageengine.com/privileged-access-management/help/adding_resources.html) for more details.

### 5. What happens if a user leaves the organization without sharing their sensitive passwords with anyone?

If an administrative user leaves the organization, they can transfer the resources they own to other administrators. By doing so, they will no longer have access to those resources unless they transfer the resources to themselves. Refer to [this document](https://www.manageengine.com/privileged-access-management/help/transferring_ownership.html) for more details.

### 6. How do I add a new Active Directory domain in PAM360?

Administrators can add new domains for both resource discovery and user discovery operations.

For resource discovery:

1. Go to the **Resource** tab and click **Discover Resources**.
2. Click **New Domain** beside the **Enter Domain Name** field.
3. Add a new domain name.

Refer to [this help section](https://www.manageengine.com/privileged-access-management/help/privileged_accounts_discovery.html#discwindows) for detailed instructions.

For user discovery:

1. Go to the **Admin** tab and click **Authentication** > **Active Directory**.
2. Click **New Domain** beside the **Enter Domain Name** field.
3. Add a new domain name.

Refer to [this help section](https://www.manageengine.com/privileged-access-management/help/active_directory_integration.html#import) for detailed instructions.

### 7. How do I remove a domain from PAM360?

To remove a domain from PAM360, first remove the users that belong to that domain. Then:

1. Go to the **Admin** tab and click **Authentication** > **Active Directory**.
2. Click **View Synchronization Schedules**.
3. Delete the required domain from the **Domains** pane on the left.

### 8. How do I fix the “The list of Groups is too large to display” and “The list of OUs is too large to display” errors while importing from AD?

Increase the number of OUs and groups allowed during AD import:

1. Stop the PAM360 service.
2. Back up the `system_properties.conf` file in the `<pam360-home>\conf` directory.
3. Open `system_properties.conf` in WordPad with administrator permissions and edit these values:
   1. Change `domain.ou.limit=2500` to `domain.ou.limit=25000`.
   2. Change `domain.group.limit=2500` to `domain.group.limit=25000`.
4. Save the file and restart the PAM360 service.

### 9. How can I edit the properties of an existing scheduled task, such as changing the time or frequency?

To create or edit scheduled tasks for AD synchronization:

1. Log in as an administrator and go to the **Groups** tab.
2. Click the **Actions** icon beside the resource group.
3. Select **Periodic Account Discovery** from the drop-down menu.
4. In the pop-up, schedule or modify the time interval for AD synchronization.

**Note:** Only the owner of a scheduled task can edit or modify existing schedules through **Admin** > **Manage** > **Scheduled Tasks**.

### 10. Can an AD sync job be set to occur multiple times a day, such as once every four hours?

Yes. Configure the schedule when importing the OU or group from AD.

Go to **Resources** > **Discover Resources** > **Import**, specify the synchronization interval as required, and import the OU or group.

### 11. How do I fix the “PAM360 detected harmful content in the data entered by the user and aborted the operation” error while importing resources through a CSV or TSV file?

As a security measure, PAM360 restricts certain characters such as HTML tags (`<`, `>`), `URL: HTTPS://`, `URL: HTTP://`, security marks (`?`), line endings, and multiple spaces in notes or other fields to avoid security violations.

If any of these characters are used in fields other than the password field, the import fails.

Verify the CSV or TSV file and remove these characters before importing.

**Note:** Ensure that resource and account descriptions do not exceed the maximum limit of 2,000 characters.

### 12. How do I troubleshoot failures when importing users or resources from AD?

Verify the following:

- Check whether the user credentials are correct.
- If importing with an administrator account fails, try credentials for a non-administrator account to verify whether a connection can be established.

If these checks fail, contact pam360-support@manageengine.com.

### 13. Can I run custom queries to generate results for integration with other reporting systems?

Yes. Contact support with your specific request, and they can provide the relevant SQL query to generate XML output.

### 14. Does domain SSO work across firewalls or VPNs?

Domain Single Sign-On, or Windows-integrated authentication, is achieved by setting non-standard HTTP header parameters. Devices such as firewalls and VPNs usually strip these parameters.

PAM360 is designed for use within the network. If users connect from outside the network, SSO cannot be enabled.

### 15. Can I rebrand PAM360 with my own logo and organizational information?

Yes. PAM360 provides these customization and rebranding options:

- Use your own logo for the web interface and mobile app. The recommended image size is 210 × 50 pixels.
- Set a login-page description.
- Change the default user-interface color.
- Display a banner with customized legal content.
- Customize privacy-policy content and display an acceptance button.

To configure these options:

1. Navigate to **Admin** > **Customization** > **Rebrand**.
2. Under **Logo and Theme**, configure a logo, login-page description, and default skin tone.
3. Under **Login Page Text**, add policies or legal conditions to display on the login page.

This configuration can be disabled at any time. [Learn how](https://www.manageengine.com/privileged-access-management/help/rebrand.html).

### 16. Does PAM360 record password-viewing attempts and retrievals by users?

Yes. PAM360 records all operations users can perform, including password viewing and copying. Audit trails provide a comprehensive list of actions and password-retrieval attempts. [Learn more](https://www.manageengine.com/privileged-access-management/help/audit_notifications.html).

### 17. Why does the size of the PostgreSQL `wal_archive` file increase rapidly?

This issue occurs when the backup location specified in PAM360 is no longer accessible for saving backup files. Whenever the PostgreSQL database backup fails, the `wal_archive` folder begins increasing in size.

**Solution:**

- Check whether enough disk space is available on the PAM360 drive.
- If not, remove the logs directory and a few files present inside the directory.
- Keep only one or two backups in the directory.
- Log in to PAM360 and navigate to **Admin** > **Configuration** > **Database Backup**.
- Click **Backup Now**.

This triggers an immediate backup and automatically purges the `wal_archive` directory.

### 18. Does PAM360 support High Availability?

Yes. Refer to the [High Availability documentation](https://www.manageengine.com/privileged-access-management/help/high-availability-pgsql.html) for more details.

### 19. What Syslog formats does PAM360 use?

PAM360 uses three Syslog formats to send messages to a Syslog collector host.

**Resource Audit**

```text
operatedName+":"+operatedIp operationType operatedDate statusMess resourceName+":"+accName+":"+reason
```

**User Audit**

```text
operatedName+":"+operatedIp operationType operatedDate statusMess auditUserName+":"+reason
```

**Key Audits**

```text
SSL: <190> Parent_Domain: manageengine.com Included_Domain: kmp.com Days_to_Expire: 100 Expire_Date: 5.08.2020
SSH: <190> Key_Name:172.21.147.130_test123_id Days_Exceeded:0 Modified_On:2016-02-16 17:41:24.008
```

### 20. Does PAM360 alter the number of Windows CAL licenses?

No. RDP sessions are invoked from the PAM360 server and relayed to the end user's browser through Spark Gateway, a third-party component bundled with PAM360. This component has no relation to Windows CAL licenses.

PAM360 does not affect the number of Windows CAL licenses. Users must purchase the number of CAL licenses recommended by Microsoft.

### 21. How do I run the PAM360 service using a group Managed Service Account?

For detailed instructions, see [running the PAM360 service using a group Managed Service Account](https://www.manageengine.com/privileged-access-management/help/installation.html#gmsa).

### 22. How do I fix PostgreSQL server startup failure?

#### Error scenarios

**During upgrade**

The command prompt displays:

```text
Trying to start PostgresSQL server failed
```

This occurs after choosing the PPM file.

**While setting up High Availability**

The command prompt displays:

```text
Trying to start PostgresSQL server failed
```

This occurs after executing `HASetup.bat`.

**During service startup**

1. PAM360 service startup failure after an upgrade.
2. PAM360 service startup failure after updating the PAM360 service account in the Services console.

For these cases, open `<PAM360-HOME>\logs\wrapper` with Notepad or Notepad++ and review the latest entries for the `Trying to start PostgresSQL server failed` error.

#### Possible causes

The error can occur when:

1. PAM360 cannot access some subfolders because appropriate permissions have not been granted.
2. The PostgreSQL database cannot start due to a background process that was not terminated properly.
3. The database port is occupied by another process.

#### Solution

1. Start Task Manager and terminate all PostgreSQL processes. Ensure **Show processes from all users** is selected.
2. Update the PAM360 service with a privileged account in the Services console.
3. Open Command Prompt as administrator and execute:

```text
icacls "installation path" /q /c /t /grant Users:F
```

   1. Replace `installation path` with the ManageEngine folder location.
   2. Replace `Users` with the PAM360 service account in this format: `<DomainName\user name>` or `<username@domainname>`.
   3. Example:

```text
icacls "C:\ProgramFiles\ManageEngine\PAM360" /q /c /t /grant ManageEngine\svcpam360:F
```

   4. If the key is stored outside the PAM360 folder, grant permissions for its location using `icacls`.
   5. Grant full-control permission to the `<PAM360>\pgsql\data` folder.
   6. Verify that `<PAM360_Installation_Directory>/pgsql/data` inherited the permission.

4. Navigate to `<PAM360_Installation_Directory>/pgsql/data`, open `pg_hba.conf`, and search for `NULL`. If found, remove the entire line containing `NULL`.
5. Rename `<PAM360_Installation_Directory>\logs` to `logs.old`, then create a new `logs` folder.
6. Rename `<PAM360_Installation_Directory>\Patch` to `Patch.old`, then create a new `Patch` folder.
7. Navigate to `<PAM360_Installation_Directory>/bin` and look for `.lock` or `lockfile` files. If present, move them to another directory.
8. Navigate to `<PAM360_Installation_Directory>/pgsql/data` and look for `recovery.conf` and `postmaster.pid`. If present, move them to another directory.
9. Try applying the PPM, configuring High Availability, or starting the service.

If the issue persists, send logs from `<PAM360_HOME>` and `<PAM360-HOME>\pgsql\data\pg_log`, along with screenshots, to pam360-support@manageengine.com.

### 23. How do I handle exceptions occurring while upgrading a PAM360 version?

**Exception 1:**

```text
Caused by: java.lang.OutOfMemoryError: GC overhead limit exceeded
```

1. Stop the PAM360 service.
2. Back up `<PAM360_Installation_Directory>` or take a VM snapshot.
3. Navigate to `<PAM360 installation directory>\bin`.
4. Open `UpdateManager.bat`, or `UpdateManager.sh` on Linux.
5. Find:

```text
$JAVA -Xmx100m $JAVA_OPTS -Dtier-type=BE -Djava.library.path=./lib/native -Dtier-id=BE1 -cp $CLASSPATH com.adventnet.tools.update.installer.UpdateManager -u conf $*
```

6. Change it to:

```text
$JAVA -Xmx2048m $JAVA_OPTS -Dtier-type=BE -Djava.library.path=./lib/native -Dtier-id=BE1 -cp $CLASSPATH com.adventnet.tools.update.installer.UpdateManager -u conf $*
```

7. Save the file, start the PAM360 service, and retry the upgrade.

If the issue persists, send logs to [pam360-support@manageengine.com](mailto:pam360-support@manageengine.com).

**Exception 2:**

```text
Trying to start the PostgreSQL server failed
```

1. Stop the PAM360 service.
2. End any PostgreSQL or `PAM360.exe` processes using Task Manager.
3. Exit the PAM360 tray icon.
4. Run the PAM360 service account using a privileged account and grant it full control of `<PAM360_Installation_Directory>` and the ManageEngine folder.
5. Open Command Prompt using the privileged account.
6. Proceed with the upgrade.

### 24. How do I perform a version upgrade using CLI mode?

**Windows**

1. Stop the PAM360 service.
2. Open Command Prompt with administrator privileges.
3. Navigate to `<PAM360_Installation_Directory>/bin` and execute:

```text
UpdateManager.bat -u conf -c -option i
```

4. Specify the `.ppm` file location on the next line.
5. Press Enter to proceed with the upgrade.

**Linux**

1. Stop the PAM360 service.
2. Open Command Prompt with administrator privileges.
3. Navigate to `<PAM360_Installation_Directory>/bin` and execute:

```text
UpdateManager.sh -u conf -c -option i -ppmPath <path_of_the_ppm_file>
```

Example:

```text
UpdateManager.sh -u conf -c -option i -ppmPath c:\pam360.ppm
```

4. Press Enter to proceed with the upgrade.

See [upgrade pack instructions](https://www.manageengine.com/privileged-access-management/upgradepack.html#instructions) for details.

### 25. Logs, reports, and CAPTCHA are unreadable after a version upgrade. How do I fix this?

Check the following:

- Review logs for this error:

```text
javax.servlet.ServletException: javax.servlet.ServletException: java.lang.Error: Probable fatal error:No fonts found.
```

- Verify whether DejaVu fonts are installed.

Use these commands to install DejaVu fonts:

```bash
# RHEL / CentOS
sudo yum install fontconfig dejavu-sans-fonts dejavu-serif-fonts

# Ubuntu / Debian
sudo apt install fonts-dejavu fontconfig

# SLES
sudo zypper install dejavu-fonts fontconfig
```

After installation:

1. Navigate to `<PAM360 Installation Directory>/conf`.
2. Open `wrapper_lin.conf` and add:

```text
wrapper.java.additional.27=-Dsun.java2d.fontpath=<Font Dir Path>
```

3. Alternatively, copy all `.ttf` files into `<PAM360 Installation Directory>/jre/lib/fonts`.
4. Restart the PAM360 service.

## Web Interface and Authentication

### 1. Can I change the default port 8282 where PAM360 is listening?

Yes.

1. Log in to PAM360 as an **Administrator**.
2. Navigate to **Admin** > **Configuration** > **PAM360 Server**.
3. Enter the required port beside **Server Port**.
4. Click **Save**.
5. Restart PAM360 for the configuration to take effect.

### 2. How do I change the PAM360 web portal access URL?

1. Log in as an administrator.
2. Navigate to **Admin** > **Settings**.
3. Click **Mail Server Settings**.
4. Enter the required URL in the **Access URL** field.
5. Save the settings.

This URL becomes the custom PAM360 web URL.

### 3. Can PAM360 be accessed from anywhere?

PAM360 is an on-premises tool installed on a physical server or virtual machine. You can access its web interface from any machine on the same LAN network through a web browser.

### 4. How do I change the binding IP address when the PAM360 server has multiple NIC cards and IP addresses?

PAM360 includes a tailored Tomcat web server and JVM. Configure the bind IP separately for each component.

**Change the web server bind IP**

1. Stop the PAM360 service.
2. Navigate to `<PAM360 installation folder>/conf` and back up `server.xml`.
3. Open `server.xml` in WordPad as administrator.
4. Locate `port="8282"` and add:

```text
address="<IP addresses of the application server>"
```

5. Save the file.
6. Start the PAM360 service.

**Change the JVM bind IP**

1. Stop the PAM360 service.
2. Navigate to `<PAM360 installation folder>/conf` and back up `wrapper.conf`.
3. Open `wrapper.conf` in WordPad as administrator.
4. Locate `wrapper.app.parameter.1` and add this line below it:

```text
wrapper.app.parameter.2=-Dspecific.bind.address=<IP addresses of the application server>
```

5. Save the file.
6. Rename `<PAM360 installation folder>/logs` to `logs_older`.
7. Start the PAM360 service.
8. Test the login page and product features such as password reset. The configured IP address will be used as the source IP.

### 5. What if users are not notified of their PAM360 accounts?

Users receive PAM360 account notifications through email. If notifications are not received, verify:

- Mail server settings are configured correctly using the SMTP server details in your environment.
- Valid credentials have been provided where required by the mail server.
- The **Sender E-Mail ID** is correctly configured, because some mail servers reject messages without a From address or from unknown domains.

### 6. What authentication schemes are available in PAM360?

PAM360 supports these authentication mechanisms:

- **Active Directory:** Authentication requests are forwarded to the configured domain controller. Users provide their username, password, and domain on the PAM360 login page. This works only for users already imported from AD and is available only when PAM360 is installed on Windows.
- **LDAP Directory:** Authentication requests are forwarded to the configured LDAP server. Users provide their username, password, and LDAP authentication option on the login page. This works only for users already imported from the LDAP directory.
- **PAM360 Local Authentication:** PAM360 authenticates users locally. This option remains available even when AD or LDAP authentication is enabled. AD and LDAP passwords are never stored in the PAM360 database. Disable local authentication for users after enabling AD or LDAP authentication.
- **Azure AD:** After integrating PAM360 with Azure Active Directory, users can log in using Azure AD credentials on Windows and Linux. PAM360 must first be added as a native client application in the Azure AD portal.
- **Smartcard Authentication:** Users must possess a smartcard and know its Personal Identification Number. Smartcard authentication bypasses other first-factor methods such as AD, LDAP, and local authentication.
- **RADIUS Authentication:** PAM360 can integrate with a RADIUS server to replace local authentication. Users must first be added to PAM360, and their PAM360 username must match their RADIUS username.
- **SAML SSO:** PAM360 acts as a service provider and integrates with identity providers using SAML 2.0. PAM360 supports integrations with Okta, AD FS, and Azure AD SSO.

**Note:** For SAML SSO, the Assertion Consumer URL is the server hostname by default. To update it:

1. Go to **Admin** > **Settings** > **Mail Server Settings**.
2. Update the URL under **Access URL**.
3. Click **Save**.

The Assertion Consumer URL under **Service Provider Details** will be updated.

### 7. What user roles are available in PAM360?

PAM360 has five predefined roles:

- Privileged Administrator
- Administrator
- Password Administrator
- Password Auditor
- Password User

An administrator can also be promoted to a [Super Administrator](https://www.manageengine.com/privileged-access-management/help/super_administrator.html), with privileges to view and manage all resources.

See [user management documentation](https://www.manageengine.com/privileged-access-management/help/user_management.html) for role access levels.

### 8. What if I forget my PAM360 login password?

If you have a valid PAM360 account, use the **Forgot Password?** link on the login page to reset your password. The supplied username and email address must match the configured account details.

The new password is sent to the respective email address. This option is unnecessary if AD or LDAP authentication is enabled.

### 9. Why do I see a security warning when accessing the PAM360 console in a browser?

The PAM360 web console uses HTTPS. PAM360 ships with a default self-signed SSL certificate, which browsers do not recognize and may trigger a warning.

You can ignore the warning when evaluating the product. In production, install an SSL certificate issued by an authorized Certificate Authority that standard browsers recognize. [Learn more](https://www.manageengine.com/privileged-access-management/help/faq.html#ssl).

## Security

### 1. How secure are my passwords in PAM360?

PAM360 provides the following security measures:

- Passwords are encrypted using **Advanced Encryption Standard (AES)** and stored in the database.
- The password database accepts connections only from its host and is not externally visible.
- Role-based, fine-grained access controls ensure that users can access passwords only according to granted permissions.
- All transactions between the PAM360 console and server occur through HTTPS.
- The built-in password generator helps create strong passwords.

### 2. How secure is Application-to-Application and Application-to-Database password management through Password Management APIs?

PAM360 provides RESTful APIs and SSH-based CLI APIs for application-to-application and application-to-database password management.

Applications communicate with PAM360 through HTTPS. PAM360 verifies application identity through SSL certificate validation and source IP address or hostname validation.

Each application or database must be registered as an API User in PAM360. During registration, specify the application-server hostname or IP address. PAM360 generates a unique REST API authentication token, which must accompany API requests.

Applications and databases can access only information explicitly delegated by an administrative user. Refer to [this document](https://www.manageengine.com/privileged-access-management/help/sharing_resources.html) for password-sharing and delegation details.

### 3. Can we install our own SSL certificates?

Yes.

1. Navigate to **Admin** > **Configuration** > **PAM360 Server**.
2. Select **JKS**, **PKCS12**, or **PKCS11** as the keystore type.
3. Upload the **Keystore File**.
4. Enter the keystore password used while generating the CSR.
5. Modify the server port if required.
6. Click **Save**.
7. Restart the PAM360 service.

### 4. How do I generate signed SSL certificates?

PAM360 runs as an HTTPS service and requires a valid CA-signed SSL certificate with a principal name matching the host on which it runs. By default, PAM360 creates a self-signed certificate on its first startup, which browsers do not trust.

To make the PAM360 server trusted:

- Obtain a signed certificate from a Certificate Authority for the PAM360 host, or
- Configure an existing CA-signed wildcard certificate for the PAM360 host.

You can generate signed SSL certificates through:

1. The Certificate Management module in PAM360.
2. OpenSSL.
3. Keytool.
4. An existing wildcard certificate.

#### Generate certificates using the Certificate Management module

1. Navigate to **Certificates** > **Create CSR**.
2. Click **Create**.
3. Select **Create CSR** or **Create CSR From KeyStore**.
4. If creating a CSR, enter the common name, SAN, organization details, location, state, country, key algorithm, key size, validity, and store password.
5. If creating from a keystore, upload the private key and enter its password.
6. Click **Create**.
7. Copy the CSR content, email it, or export the CSR or private key.
8. View saved CSRs under **Certificates** > **Create CSR**.

![](https://www.manageengine.com/privileged-access-management/help/images/faq-ssl-certif.png)

**Note:** The show-passphrase icon beside each CSR allows administrators to view CSR keystore passwords.

To sign a certificate:

1. Navigate to **Certificates** > **Create CSR**.
2. Select the CSR.
3. Click **Sign**.
4. Enter the internal certificate-authority server name, CA name, and certificate template.
5. Click **Sign Certificate**.

The signed certificate is available under **Certificates** > **Certificates**.

To apply the certificate keystore:

1. Navigate to **Certificates** > **Certificates**.
2. Click the signed certificate under **Common Name**.
3. Export the certificate.
4. Go to **Certificates** > **Create CSR**.
5. Use **Import Certificate** for the relevant CSR and upload the certificate.
6. Export the certificate keystore from the certificate details page.
7. Navigate to **Admin** > **Configuration** > **PAM360 Server**.
8. Select the appropriate keystore type: **JKS**, **PKCS12**, or **PKCS11**.
9. Upload the keystore file.
10. Enter the keystore password.
11. Modify the server port if required.
12. Save and restart PAM360.

#### Generate certificates using OpenSSL

Download OpenSSL for Windows from [OpenSSL for Windows](http://www.slproweb.com/products/Win32OpenSSL.html) if it is not installed. Include the OpenSSL `bin` folder in the `PATH` environment variable.

Create the private key:

```bash
openssl genrsa -des3 -out <privatekey_filename>.key 1024
```

Enter `passtrix` or another passphrase containing only alphabetic characters when prompted.

Create the CSR:

```bash
openssl req -new -key <privatekey_filename>.key -out <certreq_filename>.csr
```

For **Common Name**, provide the fully qualified domain name of the PAM360 server.

Submit the CSR to a CA such as [Verisign](http://verisign.com), [Thawte](http://www.thawte.com), or [RapidSSL](http://www.rapidssl.com/index.html). Save the signed SSL certificate and CA root certificate as `.cer` files.

Create a PKCS12 keystore:

```bash
openssl pkcs12 -export -in <cert_file>.cer -inkey <privatekey_filename>.key -out <keystore_filename>.p12 -name PAM360 -CAfile <root_cert_file>.cer -caname PAM360 -chain
```

Use the same password used for the private key.

Copy the generated `.p12` file to `<PAM360_Install_Folder>\conf`, then edit `server.xml`:

- Change `keystoreFile` from `conf/server.keystore` to `conf/<keystore_filename>.p12`.
- For version 9700 and later, change `keystorePassEncrypted=true` to `keystorePassEncrypted=false` before manually updating the password.
- Set `keystorePass` to `passtrix` or your chosen password.
- Add `keystoreType=PKCS12` or `PKCS11`.

Save the file and restart PAM360.

#### Generate certificates using Keytool

Create a key pair:

```bash
./keytool -genkey -alias PAM360 -keyalg RSA -sigalg SHA256withRSA -keypass <privatekey_password> -storepass <keystore_password> -validity <no_of_days> -keystore <keystore_filename>
```

The private-key and keystore passwords must be identical. For the first and last name, enter the FQDN of the PAM360 server.

Create a CSR:

```bash
keytool -certreq -keyalg RSA -alias PAM360 -keypass <privatekey_password> -storepass <keystore_password> -file <csr_filename> -keystore <keystore_filename>
```

The CSR filename must use a `.csr` extension.

After receiving the CA-signed certificate, import it.

For a `.p7b` certificate bundle:

```bash
keytool -import -alias PAM360 -keypass <privatekey_password> -storepass <keystore_password> -keystore <keystore_filename> -trustcacerts -file <your_ssl_bundle.p7b>
```

For separate root, intermediate, and server certificates:

```bash
keytool -import -alias root -keypass <privatekey_password> -storepass <keystore_password> -keystore <keystore_filename> -trustcacerts -file <rooter>
keytool -import -alias inter -keypass <privatekey_password> -storepass <keystore_password> -keystore <keystore_filename> -trustcacerts -file <inter.cer>
keytool -import -alias PAM360 -keypass <privatekey_password> -storepass <keystore_password> -keystore <keystore_filename> -trustcacerts -file <your_ssl_cert.cer>
```

Copy the keystore file to `<PAM360_Home>/conf`, update `server.xml`, set the keystore password, and restart PAM360.

#### Use an existing wildcard certificate

1. Go to `<PAM360_Home>/conf`.
2. Open `server.xml`.
3. Change `keystoreFile` from `conf/server.keystore` to `conf/<keystore_filename>`.
4. Change `keystorePass` from `passtrix` to the wildcard certificate keystore password.
5. Restart PAM360.

**Note:** Refer to your CA documentation for troubleshooting details.

### 5. How do I make the PAM360 server trusted by web browsers and users?

Install a CA-signed SSL certificate for the PAM360 host or configure an existing CA-signed wildcard certificate.

Use one of these methods:

1. The PAM360 Certificate Management module.
2. OpenSSL.
3. Keytool.
4. A wildcard certificate.

Refer to the signed SSL certificate instructions in the preceding section.

### 6. Can we create server certificates with Subject Alternative Name?

Yes. You can create and apply a SAN certificate in PAM360.

Use PAM360's SSL certificate management module:

1. Log in as an administrator.
2. Navigate to **Certificates** > **Create CSR**.
3. Click **Create**.
4. Provide a certificate name.
5. Provide a common name; the Subject Alternative Name is automatically populated.
6. Add additional SANs if required.
7. Enter organization details, location, validity, and password.
8. Click **Create**.
9. Export the CSR and private key or send the CSR to an email address.

Submit the CSR to a CA:

1. Export the CSR and send it to a third-party CA, or
2. Navigate to **Certificates** > **Create CSR**, select the certificate, and click **Sign** to use a Microsoft CA or a custom root CA.

See [certificate signing documentation](https://www.manageengine.com/privileged-access-management/help/manage_ssl_certificates.html#CertificateSigning) for details.

To import a CA-signed certificate:

1. Navigate to **Certificates**.
2. Click **Add**.
3. Choose one of the following:
   - **File Based Certificate:** Browse and import a certificate file.
   - **Content Based Certificate:** Paste certificate content.
   - **Keystore Based:** Import all certificates contained in a keystore.
4. Click **Add**.

For Microsoft internal CA, execute:

```bash
certutil -setreg policy\EditFlags +EDITF_ATTRIBUTESUBJECTALTNAME2
```

Restart Microsoft Certificate Service, then create a private key:

```bash
./keytool -genkey -alias PAM360 -keyalg RSA -keypass <privatekey_password> -storepass <keystore_password> -validity <no_of_days> -sigalg SHA256withRSA -keysize 2048 -keystore <keystore_filename>
```

Create the CSR:

```bash
keytool -certreq -keyalg RSA -alias PAM360 -keypass <privatekey_password> -storepass <keystore_password> -file <csr_filename> -keystore PAM360.keystore
```

When submitting to the internal CA, select the **Web Server** certificate template and add the SAN in additional attributes:

```text
san:dns=passwordmanager&dns=passwordmanager.tcu.ad.local
```

Import the resulting certificate bundle:

```bash
keytool -import -alias PAM360 -keypass <privatekey_password> -storepass <keystore_password> -keystore PAM360.keystore -trustcacerts -file PAM360cert.p7b
```

If you receive `Failed to establish chain from reply`, import the root and intermediate certificates first:

```bash
./keytool -import -alias root1 -keypass Password123 -storepass Password123 -keystore PAM360.keystore -trustcacerts -file root1.cer
./keytool -import -alias root2 -keypass Password123 -storepass Password123 -keystore PAM360.keystore -trustcacerts -file root2.cer
```

Apply the keystore:

1. Log in as an administrator.
2. Navigate to **Admin** > **Configuration** > **PAM360 Server**.
3. Select **PKCS12** or **PKCS11** as the keystore type.
4. Browse for the PFX or P12 file.
5. Enter the keystore password.
6. Save the configuration.
7. Restart PAM360.

## Password Synchronization

### 1. Can I change resource passwords from the PAM360 console?

Yes. PAM360 can remotely reset passwords on various endpoints using agent-based and agentless modes. Refer to [this document](https://www.manageengine.com/privileged-access-management/help/remote_password_reset.html) for details.

### 2. When should I use agent-based and agentless password synchronization?

The agent mode requires the PAM360 agent to be installed as a service on each endpoint with administrative privileges. The agent uses outbound, one-way communication to reach the PAM360 server.

For agentless mode, provide administrative credentials for password changes:

- For Linux, provide a root-privileged account and a normal user account for remote login.
- Telnet or SSH must run on Linux resources.
- For Windows domains, provide domain-administrator credentials.
- Relevant ports must be open because PAM360 uses remote calls for Windows and Windows domains.

Choose **agent mode** when:

- Administrative credentials are not stored in PAM360 for a resource.
- Required services are not running, such as Telnet or SSH on Linux, or RPC on Windows.
- PAM360 runs on Linux and must change passwords on Windows resources.

Choose **agentless mode** in other cases because it is more convenient and reliable.

### 3. Can I enable agentless password reset for custom Linux or Windows resource types?

Yes. As long as the resource type label includes `Linux` or `Windows`, you can configure agentless password reset.

Examples:

```text
Debian Linux
Linux - Cent OS
SuSE Linux
Windows XP Workstation
Windows 2003 Server
```

### 4. Can I remotely synchronize passwords for custom resource types?

Yes. PAM360 supports remote password resets for custom resource types using:

- **SSH Command Sets:** Build command-based executables from default or customized SSH commands and associate them with SSH device accounts.
- **Password Reset Plugin:** Build an implementation class to enforce automatic password resets for custom resource types. Plugins can reset passwords immediately after use, creating one-time passwords.
- **Password Reset Listeners:** Configure custom scripts or executables for local password changes and remote password resets of custom resource types.

### 5. How do I troubleshoot password reset failures?

**Agent mode**

- Verify that the agent is running by checking for `PAM360Agent.exe` in Windows active processes or `PAM360Agent` in Linux processes.
- Verify that the account running the agent has enough privileges to change passwords.

**Agentless mode**

- Verify that administrative credentials are correct and remote synchronization is enabled.
- Verify that required services are running: Telnet or SSH for Linux, and RPC for Windows.
- Verify that the resource can be reached from the PAM360 server using its DNS name.

### 6. How do I reset domain passwords when Windows domain password reset fails with “The authentication mechanism is unknown”?

This occurs when PAM360 runs as a Windows service and its **Log On As** property is set to the local system account.

1. Open Windows Services through **Control Panel** > **Administrative Tools** > **Services**.
2. Select the **ManageEngine PAM360** service.
3. Open **Properties**.
4. Open the **Log On** tab.
5. Select **This Account**.
6. Enter a domain-user account in the format `<domainname>\<username>`.
7. Save the configuration and restart the server.

### 7. What are the prerequisites for Windows Service Account Reset?

Ensure that these services are enabled on servers where dependent services run:

- Windows RPC service
- Windows Management Instrumentation, or WMI, service

### 8. Does domain SSO work across firewalls or VPNs?

No. Windows-integrated authentication uses non-standard HTTP header parameters that firewalls and VPNs usually strip. PAM360 is intended for internal-network use; users connecting from outside the network cannot use domain SSO.

## Backup and Disaster Recovery

### 1. Can I move PAM360 from one server to another?

Yes.

1. Stop the PAM360 service and exit the tray icon.
2. Ensure PostgreSQL is not running in Task Manager.
3. Copy the entire PAM360 directory to the new server.
4. Open Command Prompt as administrator and navigate to `<PAM360 HOME>\bin`.
5. Run:

```text
PAM360.bat install
```

6. Move the encryption key, `PAM360_key.key`, to the new server.
7. Specify its correct location in `PAM360/conf/manage_key.conf`.
8. See [encryption-key documentation](https://www.manageengine.com/privileged-access-management/help/installation.html#managing) for more information.
9. In the Services console, provide a service account and start the PAM360 service.
10. To enable the tray icon, right-click `PAM360.exe` in `<PAM360 HOME>` and select **Run as Administrator**.

Access the PAM360 web page using the new server name in the URL.

### 2. Can I set up disaster recovery for the PAM360 database?

Yes. PAM360 can periodically back up the entire database through the PAM360 console. Refer to [this document](https://www.manageengine.com/privileged-access-management/help/db_backup.html) for details.

### 3. Where is backup data stored, and is it encrypted?

Sensitive data in backup files is encrypted using the **7-Zip** utility with **AES256** encryption.

Encrypted backup data is stored as a `.zip` file in:

```text
<PAM360_Install_Directory/backUp>
```

Store backups in secure secondary storage for disaster recovery.

## Licensing

### 1. What is the licensing policy for PAM360?

PAM360 has three license types:

1. **Evaluation Download / Trial Version:** Fully functional for 30 days and supports up to **5 administrators**.
2. **Free Edition:** Supports **1 administrator** and up to **10 resources**. It is valid forever.
3. **Registered Version:** Provides the Enterprise edition. Licensing is based on the number of administrators and includes enterprise features such as privileged-account auto-discovery, ticketing and SIEM integration, jump-server configuration, application-to-application password management, compliance reports, and SQL Server or cluster backends.

**Note:** PAM360 has five user roles: Administrator, Password Administrator, Privileged Administrator, Password Auditor, and Password User.

For licensing, the term **administrator** includes Administrators, Password Administrators, and Privileged Administrators. There are no restrictions on the number of Password Users or Password Auditors. See [user management documentation](https://www.manageengine.com/privileged-access-management/help/user_management.html) for details.

### 2. Can I buy a permanent PAM360 license?

Yes. Although PAM360 follows an annual subscription model, perpetual licensing is available.

The perpetual license costs three times the annual subscription price, with 20% AMS from the second year. Contact [sales@manageengine.com](mailto:sales@manageengine.com) for details.

### 3. How do I apply my license file?

1. Log in as an administrator in the PAM360 web interface.
2. Click the **My Account** icon in the upper-right corner.
3. Select **License**.
4. Browse for the license file.
5. Click **Upgrade**.
6. Restart the PAM360 service.

License details are available in the same section.

### 4. Does a single license suffice for a High Availability setup?

Yes. A single license can be applied to both the primary and secondary servers.

1. Stop the PAM360 service on the primary server.
2. Log in to PAM360 using the secondary-server URL as an **Administrator**.
3. Select **License** under the **User** menu in the upper-right corner.
4. Upload the same license file used on the primary server.

### 5. Can PAM360 support more than 1,000 administrators?

Yes. Contact [sales@manageengine.com](mailto:sales@manageengine.com) for licensing details for more than 1,000 administrator users.

### 6. Can I extend my evaluation for more administrator users or more days?

Yes. Provide the required details on the [ManageEngine store website](https://store.manageengine.com/privileged-access-management/index.html), and license keys will be sent to you.

### 7. How many resources and accounts can I manage using PAM360?

PAM360 licensing has no limits on the number of resources and accounts you can manage. You can add or import any number of supported resources and manage accounts without restrictions.

## SSH Key Management

### 1. Are SSH user accounts and SSH service accounts managed differently in PAM360?

No. PAM360 manages both SSH user accounts and service accounts the same way.

During resource discovery, if service or root credentials are provided, PAM360 receives extended privileges to import and manage keys for all user accounts on the resource.

If the connection is established using user-account credentials, key-management privileges are limited to SSH keys in that particular account.

### 2. Can I view SSH keys that were not rotated?

Yes. The PAM360 dashboard displays the number of keys that were not rotated within the predefined period specified in the notification policy.

### 3. Does PAM360 manage digital keys other than SSH keys and SSL certificates?

PAM360 includes a key vault called **Key Store**, which supports storage and management of any type of digital key.

However, discovery and import are limited to SSH keys and SSL certificates. Other digital key types cannot be discovered or imported automatically.

## SSL Certificate Management

### 1. Is PAM360 incompatible with any certificate type?

No. PAM360 supports all X.509 certificate types.

### 2. Can PAM360 automatically identify and update the latest certificate versions in its certificate repository?

Yes. Create scheduled tasks for automatic certificate discovery. These tasks can import updated certificates and replace older versions in the PAM360 certificate repository.

See [certificate discovery schedules](https://www.manageengine.com/privileged-access-management/help/SSH_and_SSL_schedules.html) for details.

### 3. Does the Linux version of PAM360 support certificate discovery from Active Directory and Microsoft Certificate Store?

No. The AD User Certificate and Microsoft Certificate Store tabs are available only in the Windows version of PAM360.

### 4. Can I track expiration for certificates with the same common name?

PAM360 differentiates certificates by common name and stores certificates with identical common names as a single certificate-repository entry. This design prevents customers from using multiple license keys for the same certificate.

To manage certificate versions separately:

1. Navigate to the **Certificates** tab.
2. Click **Certificates**.
3. Click the **Certificate History** icon beside the certificate.
4. Click the **Certificate Settings** icon beside the required certificate version.
5. Select **Manage Certificate**.

The selected version is listed as a separate certificate in the repository and is counted for licensing.

To manage only one version, select **Set as current certificate** from the certificate version's **Certificate Settings** menu.

### 5. How do I import a private key for a certificate?

1. Navigate to the **Certificates** tab and click **Certificates**.
2. Select the certificate that requires a private key.
3. Click **Import Keys** from the **More** drop-down menu.
4. Browse for the file containing the private key.
5. Enter the keystore password.
6. Click **Import**.

The private key is imported and attached to the selected certificate.

### 6. How do I deploy a certificate to Certificate Store and map it to the application using it?

PAM360 supports certificate deployment from its repository to a target server's Microsoft Certificate Store.

See [certificate deployment instructions](https://www.manageengine.com/privileged-access-management/help/deploy_ssl_certificates.html) for step-by-step details.

To map the certificate to the corresponding application, manually restart the server running the application.

### 7. Does PAM360 support subnet-based certificate discovery?

No. PAM360 does not currently support subnet-based SSL certificate discovery.

### 8. Does PAM360 support automatic scheduling for certificate discovery from Microsoft Certificate Store?

No. PAM360 does not currently support automatic scheduling for certificate discovery from Microsoft Certificate Store.

### 9. Are certificate alert emails generated for every certificate version in Certificate History?

No. Email notifications are generated only for certificates listed in the PAM360 certificate repository, not for different certificate versions displayed in **Certificate History**.

### 10. Are certificates issued by an organization's internal Certificate Authority counted for licensing?

Yes. All SSL certificates, SSH keys, and other digital keys managed using PAM360 are considered for licensing.

The **License Details** dashboard widget provides information about the type and number of digital identities managed by PAM360 that are counted for licensing.

### 11. How do I import a root certificate into PAM360?

Open Command Prompt, navigate to `<pam360_server_home>\bin`, and run one of the following commands.

**Windows**

```text
importCert.bat <Absolute Path of certificate>
```

**Linux**

```text
importCert.sh <Absolute Path of certificate>
```