> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Getting Started with Password Management

> Sequence and prerequisites for setting up Syteca Privileged Access Management — Web Connection Manager (launch locally or in browser), Desktop Connection Manager on a jump server, secret types, and the third-party apps required.

## From a fresh license to managed privileged access

Syteca's **Password Management** (PAM) feature — combined with [Account Discovery](/docs/pam/discovery/overview) — handles the privileged-credential side of the platform: shared admin accounts, service accounts, jump-server connections, and any other "the password is in a spreadsheet somewhere" scenario every organization eventually runs into. Credentials are stored as **secrets** in encrypted form, role-based access control governs who can use which secret, and the platform supports the **JIT (Just-In-Time) PAM** approach — credentials are only retrieved (and optionally rotated) at the moment of use.

This page is the **orientation sequence** for someone with a fresh PAM license. It walks the order of operations, flags prerequisites, and links to the detailed feature pages where each step is covered in full.

<Info>
  **PAM seat licenses must be assigned first.** PAM functionality is gated by per-user PAM seat licenses. [Assign PAM seat licenses](/docs/administration/licensing/assign-pam-seat-licenses) to the Management Tool users who'll be using PAM — without a PAM seat, users can't access the Password Management page, the Account Discovery page, Syteca Desktop Connection Manager, or Syteca Web Connection Manager.
</Info>

<Note>
  PAM requires an activated [serial key](/docs/administration/licensing/manage-serial-key) that includes the **Password Management** application and PAM seat licenses. Confirm on the **Configuration → Serial Key Management** tab that both are present before starting.
</Note>

## Pick how users will access secrets

Syteca supports two complementary access paths. Most deployments configure both — one for ad-hoc admin use, one for routine jump-server access.

| Access path                                                                                                 | Best for                                                                                                                                  | Requires Syteca Client on the user's computer?                                        |
| ----------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| **[Syteca Web Connection Manager](/docs/pam/access/web-connection-manager) — Launch locally**                    | Power admins working from their own workstation; need session recording                                                                   | **Yes** — Syteca Client installed (in a specific way; see Step 1 below).              |
| **[Syteca Web Connection Manager](/docs/pam/access/web-connection-manager) — Launch in browser (agentless PAM)** | Auditors, occasional users, or any computer where you can't install a Client. Supports Active Directory, Windows, and Unix (SSH) secrets. | **No** — purely in-browser. **No session recording.**                                 |
| **[Syteca Desktop Connection Manager](/docs/pam/access/desktop-connection-manager) (on a jump server)**          | Routine privileged access for many users via a hardened jump server; standard PAM pattern                                                 | The jump-server Windows Client computer needs the Desktop Connection Manager enabled. |

Web Connection Manager (Launch in browser) is Syteca's **agentless PAM** option — useful when comparing against agent-heavy competitors. Note that agentless mode trades off session recording: choose Launch locally when activity recording is required.

## 1. Configure Web Connection Manager (Launch locally)

If you'll use Launch Locally:

<Steps>
  <Step title="Enable activity recording per secret">
    For any secret where activity must be recorded, **select Record user activity while the secret is in use** on the secret's [Security tab](/docs/pam/secrets/add-secret).

    <Warning>
      The **Launch in browser** option is **not available** for any secret where **Record user activity while the secret is in use** is enabled. The two options are mutually exclusive per secret.
    </Warning>
  </Step>

  <Step title="Install the Syteca Client in the special PAM way">
    On the user's workstation, the Syteca Client must be installed via the **Download Syteca Client** button that appears inside the Web Connection Manager — **not** via the normal Client installation method. This special install adds the Client to a dedicated **PAM Clients** group and configures it for Launch Locally specifically.

    From the **Password Management** page, hover over any secret in the grid, click **Launch** in the floating bar, and choose **Launch locally**. The page that opens has a **Download Syteca Client** button — use this to download the installer, then [install it normally](/docs/administration/clients/install-windows#local-installation-without-an-ini-file).

    <Note>
      If the user's machine already has a Syteca Client installed by other means, it must be **re-installed via the Download Syteca Client button** for Launch Locally to work. (You don't need to uninstall first — the new install replaces the old.)
    </Note>

    <Warning>
      Clients in the **PAM Clients** group can't be added to any other Client group and can only be removed by uninstalling and deleting them on the Clients page. The **PAM Clients** group itself can't be deleted.
    </Warning>
  </Step>
</Steps>

## 2. Configure Web Connection Manager (Launch in browser)

If you'll use Launch in Browser (agentless PAM), some heavy prerequisites apply on the Management Tool host.

<Info>
  **Prerequisites on the Management Tool computer:**

  * **Supported browsers:** Microsoft Edge and Google Chrome.
  * **Windows Server 2022 or higher** on the Management Tool computer.
  * **Hyper-V role** and **Windows Subsystem for Linux (WSL)** feature must be installed via Windows Server Manager.
  * **Windows Server 2025 specifically** requires **WSL 2** (with the **Virtual Machine Platform** feature enabled) — see [Microsoft's WSL 2 installation docs](https://learn.microsoft.com/en-us/windows/wsl/install) and the [manual installation steps for older WSL versions](https://learn.microsoft.com/en-us/windows/wsl/install-manual).
  * After installing the prerequisites, **restart** the Application Server host.
</Info>

<Note>
  **IN SAAS ONLY:** Launch in browser is not enabled by default in SaaS. Contact your Syteca vendor or Syteca Support to enable it for your tenant.
</Note>

<Steps>
  <Step title="Open the Web Connection Manager config">
    Sign in to the Management Tool as a user with **both** the [administrative Privileged Accounts Management and Tenant Management and System Configuration permissions](/docs/administration/users/administrative-permissions).

    Click the **gear** icon at the top of the Management Tool, then select the **Web Connection Manager** tab.

    <Note>
      The **Web Connection Manager** tab only appears when the Password Management (PAM) toggle is enabled in your [serial key](/docs/administration/licensing/manage-serial-key).
    </Note>
  </Step>

  <Step title="Enable and configure the certificate">
    Move **Enable Syteca Web Connection Manager** to the right. Pick one:

    * **Use an auto-created trusted self-signed certificate** (default) — generates a self-signed certificate for the Apache Guacamole server automatically.
    * **Import certificate and Import private key** — for custom certificates (more appropriate for production deployments).
  </Step>

  <Step title="Set the port and validate">
    Use the default port `4822` for Apache Guacamole (or set a different port). Click **Validate and Set Up** — Syteca will install Apache Guacamole if it's not present and verify the configuration.

    Common validation errors:

    | Error                                                        | Resolution                                      |
    | ------------------------------------------------------------ | ----------------------------------------------- |
    | "The certificate or private key is invalid or not supported" | Import a valid certificate and private key.     |
    | "Port `<4822>` is in use by another application"             | Free the port or choose a different one.        |
    | "Insufficient disk space available"                          | At least **220 MB** free is required.           |
    | "The required Windows features for WSL are not enabled"      | Install WSL and Hyper-V (Step 2 prerequisites). |
    | "The latest version of WSL is required. Please upgrade WSL." | Upgrade WSL to v.2 or higher.                   |

    <Note>
      In **High Availability mode**, click **Validate and Set Up** on **each** Management Tool (i.e. on each node for each Application Server instance).
    </Note>
  </Step>

  <Step title="Adjust Resource Optimization (optional)">
    In the **Browser Connection Settings** section, the **Resource Optimization Mode** toggle is on by default — it reduces visual effects to improve connection stability and decrease resource usage. Disable it only if you need full visual fidelity and your environment can handle the load.

    <Note>
      In **Multi-Tenant mode**, these settings apply to **all tenants** but can only be set by a user of the built-in default tenant.
    </Note>
  </Step>
</Steps>

## 3. Configure Desktop Connection Manager on a jump server

If you'll use Desktop Connection Manager (most common for routine privileged access):

<Note>
  A jump-server computer is **only required if two or more concurrent sessions are needed** on the Client computer with Syteca Connection Manager. **Windows Server** is recommended for correct Syteca Connection Manager operation on a jump server.
</Note>

<Note>
  Syteca Desktop Connection Manager requires **.NET Framework 4.8** on the Client computer.
</Note>

<Steps>
  <Step title="Open the jump server Client config">
    Click **Clients** in the left navigation. Find the Windows Client that will serve as the jump server and click its name in the **Client Name** column.
  </Step>

  <Step title="Enable Connection Manager">
    On the **Properties** tab, scroll to the **Client Mode** section and select:

    * **Enable the Syteca PAM Connection Manager** — turns on the desktop Connection Manager on this Client.
    * *(Optional)* **Replace Windows Shell with the Syteca PAM Connection Manager** — replaces the Windows desktop with the Connection Manager window for a tightly-restricted jump-server experience.

    <Note>
      When the Windows shell is replaced, the Connection Manager shortcut icon may not appear on the desktop — find it in `C:\Users\Public\Desktop`.
    </Note>
  </Step>

  <Step title="Enable secondary authentication">
    On the **Authentication Options** tab, scroll to the **Two-Factor and Secondary Authentication** section, then select **Enable secondary user authentication on login**. This identifies which Management Tool user is using the shared jump-server account.

    <Note>
      Secondary authentication is **not required for Active Directory users** — AD identity is already established at sign-in.
    </Note>
  </Step>

  <Step title="Finish">
    Click **Finish** to save. Users with the appropriate PAM seat licenses and secret permissions can now use Syteca Connection Manager on this Client.
  </Step>
</Steps>

## 4. Add secrets

[Add a secret](/docs/pam/secrets/add-secret) for each shared account you want to manage. The secret wizard walks through:

* **Properties** — name, secret type (Active Directory / Windows / Unix SSH / Unix Telnet / Web / MS SQL), folder.
* **Account** — domain, computer, login, password (or SSH key for Unix SSH).
* **Automation** — optional [Remote Password Rotation](/docs/pam/secrets/remote-password-rotation) and rotation frequency.
* **Security** — optional [Password Checkout](/docs/pam/secrets/password-checkout) for single-user-at-a-time access, **Record user activity while the secret is in use**, optional auto-check-in after a time period.
* **Permissions** — [Role Type permissions](/docs/pam/secrets/permissions) (Owner / Editor / PAM User) plus advanced permissions (View Password, Copy Password, File Transfer).
* **Restrictions** — optional approval workflow on secret use ("Always require approval," "Allow access without approval during work hours").

## 5. Use secrets

Once secrets are configured, users with the right permissions can connect through Syteca Connection Manager (desktop) or [Syteca Web Connection Manager](/docs/pam/access/web-connection-manager). The exact mechanics depend on the secret type — see [Use secrets](/docs/pam/secrets/use-secrets) for the per-type workflows.

## Third-party applications required on the user's computer

Different secret types use different third-party applications under the hood. Make sure these are installed on each user's computer that uses Desktop Connection Manager or Web Connection Manager Launch Locally:

| Secret type                  | Third-party application required                                                                                                                                  |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Active Directory account** | Microsoft Remote Desktop Connection (`mstsc.exe`)                                                                                                                 |
| **Windows account**          | Microsoft Remote Desktop Connection (`mstsc.exe`)                                                                                                                 |
| **Unix account (SSH)**       | PuTTY                                                                                                                                                             |
| **Unix account (Telnet)**    | *(none — terminal built in)*                                                                                                                                      |
| **Web account**              | Google Chrome — **and Web account secrets always open in Incognito mode**, so no browser cache. A Syteca Chrome extension is available if auto-fill doesn't work. |
| **MS SQL account**           | Microsoft SQL Server Management Studio (SSMS) — **versions 18-20**                                                                                                |

<Note>
  **File Transfer** (available for Active Directory, Windows, and Unix SSH secrets) uses the WinSCP application — see [Transfer files using WinSCP](/docs/pam/secrets/file-transfer).
</Note>

## Related

<CardGroup cols={2}>
  <Card title="PAM overview" icon="key" href="/docs/pam/overview">
    Conceptual overview of Syteca's PAM capabilities and how secrets, Connection Managers, and Account Discovery fit together.
  </Card>

  <Card title="Add a secret" icon="plus" href="/docs/pam/secrets/add-secret">
    Full wizard reference — secret types, fields, restrictions.
  </Card>

  <Card title="Web Connection Manager" icon="globe" href="/docs/pam/access/web-connection-manager">
    Detailed config for both Launch Locally and Launch in Browser (agentless PAM).
  </Card>

  <Card title="Desktop Connection Manager" icon="monitor" href="/docs/pam/access/desktop-connection-manager">
    Configure a Windows jump server with Syteca Desktop Connection Manager.
  </Card>
</CardGroup>