Skip to main content

​
From a fresh license to managed privileged access

Syteca’s Password Management (PAM) feature — combined with Account Discovery — handles the privileged-credential side of the platform: shared admin accounts, service accounts, jump-server connections, and any other “the password is in a spreadsheet somewhere” scenario every organization eventually runs into. Credentials are stored as secrets in encrypted form, role-based access control governs who can use which secret, and the platform supports the JIT (Just-In-Time) PAM approach — credentials are only retrieved (and optionally rotated) at the moment of use. This page is the orientation sequence for someone with a fresh PAM license. It walks the order of operations, flags prerequisites, and links to the detailed feature pages where each step is covered in full.
PAM seat licenses must be assigned first. PAM functionality is gated by per-user PAM seat licenses. Assign PAM seat licenses to the Management Tool users who’ll be using PAM — without a PAM seat, users can’t access the Password Management page, the Account Discovery page, Syteca Desktop Connection Manager, or Syteca Web Connection Manager.
PAM requires an activated serial key that includes the Password Management application and PAM seat licenses. Confirm on the Configuration → Serial Key Management tab that both are present before starting.

​
Pick how users will access secrets

Syteca supports two complementary access paths. Most deployments configure both — one for ad-hoc admin use, one for routine jump-server access. Web Connection Manager (Launch in browser) is Syteca’s agentless PAM option — useful when comparing against agent-heavy competitors. Note that agentless mode trades off session recording: choose Launch locally when activity recording is required.

​
1. Configure Web Connection Manager (Launch locally)

If you’ll use Launch Locally:
1

Enable activity recording per secret

For any secret where activity must be recorded, select Record user activity while the secret is in use on the secret’s Security tab.
The Launch in browser option is not available for any secret where Record user activity while the secret is in use is enabled. The two options are mutually exclusive per secret.
2

Install the Syteca Client in the special PAM way

On the user’s workstation, the Syteca Client must be installed via the Download Syteca Client button that appears inside the Web Connection Manager — not via the normal Client installation method. This special install adds the Client to a dedicated PAM Clients group and configures it for Launch Locally specifically.From the Password Management page, hover over any secret in the grid, click Launch in the floating bar, and choose Launch locally. The page that opens has a Download Syteca Client button — use this to download the installer, then install it normally.
If the user’s machine already has a Syteca Client installed by other means, it must be re-installed via the Download Syteca Client button for Launch Locally to work. (You don’t need to uninstall first — the new install replaces the old.)
Clients in the PAM Clients group can’t be added to any other Client group and can only be removed by uninstalling and deleting them on the Clients page. The PAM Clients group itself can’t be deleted.

​
2. Configure Web Connection Manager (Launch in browser)

If you’ll use Launch in Browser (agentless PAM), some heavy prerequisites apply on the Management Tool host.
Prerequisites on the Management Tool computer:
  • Supported browsers: Microsoft Edge and Google Chrome.
  • Windows Server 2022 or higher on the Management Tool computer.
  • Hyper-V role and Windows Subsystem for Linux (WSL) feature must be installed via Windows Server Manager.
  • Windows Server 2025 specifically requires WSL 2 (with the Virtual Machine Platform feature enabled) — see Microsoft’s WSL 2 installation docs and the manual installation steps for older WSL versions.
  • After installing the prerequisites, restart the Application Server host.
IN SAAS ONLY: Launch in browser is not enabled by default in SaaS. Contact your Syteca vendor or Syteca Support to enable it for your tenant.
1

Open the Web Connection Manager config

Sign in to the Management Tool as a user with both the administrative Privileged Accounts Management and Tenant Management and System Configuration permissions.Click the gear icon at the top of the Management Tool, then select the Web Connection Manager tab.
The Web Connection Manager tab only appears when the Password Management (PAM) toggle is enabled in your serial key.
2

Enable and configure the certificate

Move Enable Syteca Web Connection Manager to the right. Pick one:
  • Use an auto-created trusted self-signed certificate (default) — generates a self-signed certificate for the Apache Guacamole server automatically.
  • Import certificate and Import private key — for custom certificates (more appropriate for production deployments).
3

Set the port and validate

Use the default port 4822 for Apache Guacamole (or set a different port). Click Validate and Set Up — Syteca will install Apache Guacamole if it’s not present and verify the configuration.Common validation errors:
In High Availability mode, click Validate and Set Up on each Management Tool (i.e. on each node for each Application Server instance).
4

Adjust Resource Optimization (optional)

In the Browser Connection Settings section, the Resource Optimization Mode toggle is on by default — it reduces visual effects to improve connection stability and decrease resource usage. Disable it only if you need full visual fidelity and your environment can handle the load.
In Multi-Tenant mode, these settings apply to all tenants but can only be set by a user of the built-in default tenant.

​
3. Configure Desktop Connection Manager on a jump server

If you’ll use Desktop Connection Manager (most common for routine privileged access):
A jump-server computer is only required if two or more concurrent sessions are needed on the Client computer with Syteca Connection Manager. Windows Server is recommended for correct Syteca Connection Manager operation on a jump server.
Syteca Desktop Connection Manager requires .NET Framework 4.8 on the Client computer.
1

Open the jump server Client config

Click Clients in the left navigation. Find the Windows Client that will serve as the jump server and click its name in the Client Name column.
2

Enable Connection Manager

On the Properties tab, scroll to the Client Mode section and select:
  • Enable the Syteca PAM Connection Manager — turns on the desktop Connection Manager on this Client.
  • (Optional) Replace Windows Shell with the Syteca PAM Connection Manager — replaces the Windows desktop with the Connection Manager window for a tightly-restricted jump-server experience.
When the Windows shell is replaced, the Connection Manager shortcut icon may not appear on the desktop — find it in C:\Users\Public\Desktop.
3

Enable secondary authentication

On the Authentication Options tab, scroll to the Two-Factor and Secondary Authentication section, then select Enable secondary user authentication on login. This identifies which Management Tool user is using the shared jump-server account.
Secondary authentication is not required for Active Directory users — AD identity is already established at sign-in.
4

Finish

Click Finish to save. Users with the appropriate PAM seat licenses and secret permissions can now use Syteca Connection Manager on this Client.

​
4. Add secrets

Add a secret for each shared account you want to manage. The secret wizard walks through:
  • Properties — name, secret type (Active Directory / Windows / Unix SSH / Unix Telnet / Web / MS SQL), folder.
  • Account — domain, computer, login, password (or SSH key for Unix SSH).
  • Automation — optional Remote Password Rotation and rotation frequency.
  • Security — optional Password Checkout for single-user-at-a-time access, Record user activity while the secret is in use, optional auto-check-in after a time period.
  • Permissions — Role Type permissions (Owner / Editor / PAM User) plus advanced permissions (View Password, Copy Password, File Transfer).
  • Restrictions — optional approval workflow on secret use (“Always require approval,” “Allow access without approval during work hours”).

​
5. Use secrets

Once secrets are configured, users with the right permissions can connect through Syteca Connection Manager (desktop) or Syteca Web Connection Manager. The exact mechanics depend on the secret type — see Use secrets for the per-type workflows.

​
Third-party applications required on the user’s computer

Different secret types use different third-party applications under the hood. Make sure these are installed on each user’s computer that uses Desktop Connection Manager or Web Connection Manager Launch Locally:
File Transfer (available for Active Directory, Windows, and Unix SSH secrets) uses the WinSCP application — see Transfer files using WinSCP.

PAM overview

Conceptual overview of Syteca’s PAM capabilities and how secrets, Connection Managers, and Account Discovery fit together.

Add a secret

Full wizard reference — secret types, fields, restrictions.

Web Connection Manager

Detailed config for both Launch Locally and Launch in Browser (agentless PAM).

Desktop Connection Manager

Configure a Windows jump server with Syteca Desktop Connection Manager.