> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Web Connection Manager

> Agentless PAM from Syteca. Launch privileged sessions to Windows, Linux, and Active Directory accounts directly from the browser — no client install on the user's machine.

## Agentless privileged access, from the browser

Syteca **Web Connection Manager** is agentless PAM: your team brokers connections to privileged Windows, Linux, and Active Directory accounts **directly from a browser**, with no software installed on the user's machine.

Traditional PAM gateways require a Syteca Client on every endpoint that users connect *from*, which is fine for office workstations but slow and painful for contractors, BYOD users, remote staff, and short-notice incident response. Web Connection Manager removes that friction: any computer with Microsoft Edge or Google Chrome can launch a brokered session in seconds, using the same [secrets](/docs/pam/secrets/add-secret) and [permissions](/docs/pam/secrets/permissions) your team already manages.

<Info>
  **Choose Web Connection Manager when you need to:**

  * Onboard contractors or third-party admins quickly, without IT touching their devices.
  * Give remote or BYOD users privileged access without deploying agents.
  * Stand up break-glass / incident-response access from any computer.
  * Eliminate the cost of installing and updating Clients on every workstation.

  **Prefer the [Desktop Connection Manager](/docs/pam/access/desktop-connection-manager) when you need full session recording**, which is currently only available with a local Syteca Client.
</Info>

This page covers both launch modes — *Launch in browser* (agentless, no recording) and *Launch locally* (with Syteca Client, recording supported) — and the setup steps for each.

<Frame caption="The Launch menu in Web Connection Manager, with Launch locally and Launch in browser.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/pam/access/wcm-launch-menu.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=f7ae4feb720cab4e3acf0e0913505b48" alt="Web Connection Manager Launch menu with both launch options" width="1098" height="622" data-path="images/pam/access/wcm-launch-menu.png" />
</Frame>

## The two launch modes at a glance

|                              | Launch in browser                            | Launch locally                                               |
| ---------------------------- | -------------------------------------------- | ------------------------------------------------------------ |
| **What it is**               | Agentless — runs in the browser              | Local — uses Syteca Client + native tools (RDP, PuTTY, etc.) |
| **Where users connect from** | Any computer with Edge or Chrome             | A Windows computer with the Syteca Client installed          |
| **Session recording**        | ✗ Not available                              | ✓ Available when enabled on the secret                       |
| **Best for**                 | Contractors, BYOD, remote, incident response | Day-to-day admins who need recorded sessions                 |

## Supported secret types

| Secret type              | Launch locally | Launch in browser |
| ------------------------ | -------------- | ----------------- |
| Active Directory account | ✓              | ✓                 |
| Windows account          | ✓              | ✓                 |
| Unix account (SSH)       | ✓              | ✓                 |
| Unix account (Telnet)    | ✓              | ✗                 |
| Web account              | ✓              | ✗                 |
| MS SQL account           | ✓              | ✗                 |

<Note>
  **Launch in browser** is not available if **Record user activity while the secret is in use** is enabled on the secret, because browser launches cannot be recorded.
</Note>

## Launch locally

### Prerequisites

If recording is required, enable **Record user activity while the secret is in use** on each relevant secret. These third-party applications must be installed on the computer where the Management Tool is used:

| Secret type                               | Application required                                |
| ----------------------------------------- | --------------------------------------------------- |
| Active Directory account, Windows account | Microsoft Remote Desktop Connection (`mstsc.exe`)   |
| Unix account (SSH)                        | PuTTY                                               |
| Unix account (Telnet)                     | None                                                |
| Web account                               | Google Chrome (opens in Incognito)                  |
| MS SQL account                            | Microsoft SQL Server Management Studio (SSMS) 18–20 |

### Install the Syteca Client for local launch

The Client must be installed in a specific way for **Launch locally** to work.

<Steps>
  <Step title="Sign in with a PAM seat license">
    Sign in to the Management Tool as a user with a [PAM seat license](/docs/administration/licensing/assign-pam-seat-licenses) and any administrative permission.
  </Step>

  <Step title="Sign in with a PAM seat license">
    Sign in to the Management Tool as a user with a [PAM seat license](/docs/administration/licensing/assign-pam-seat-licenses) and any administrative permission.
  </Step>

  <Step title="Open the Launch menu">
    Hover over a secret you have permission to use, click **Launch** in the floating bar, and select **Launch locally**.
  </Step>

  <Step title="Download the Client">
    On the page that opens in a new tab, if the Client isn't yet installed this way, click **Download Syteca Client**, then [install it](/docs/administration/clients/install-windows).

    <Note>
      If the Client was previously installed on this computer but **not** via the Download Syteca Client button, re-install it using that button. You do not need to uninstall or delete it in the Management Tool first.
    </Note>
  </Step>

  <Step title="Confirm the PAM Clients group">
    After install, the Client is automatically added to the default **PAM Clients** group.

    <Note>
      The PAM Clients group is used only for the Launch locally option and allows recording (when enabled on the secret). Clients in it can't be added to other groups and can only be removed by uninstalling and then deleting them on the Clients page. The group itself can't be deleted.
    </Note>
  </Step>
</Steps>

## Launch in browser

### Prerequisites

* Supported browsers: **Microsoft Edge** and **Google Chrome**.
* The Management Tool computer must run **Windows Server 2022** or higher.
* Plan for **1 CPU core and 2 GB RAM** per 25 secrets launched concurrently in the browser, on the [Management Tool computer](/docs/get-started/requirements/application-server).
* The **Windows Subsystem for Linux (WSL)** feature and **Hyper-V** role must be installed on the Management Tool computer.

<Steps>
  <Step title="Install WSL and Hyper-V">
    Use Windows Server Manager to install the **WSL** feature and **Hyper-V** role, then restart the Application Server computer.
  </Step>

  <Step title="Upgrade to WSL 2 (Windows Server 2025 only)">
    On Windows Server 2025, install WSL version 2 (enable the **Virtual Machine Platform** feature first), then restart again. See [Install WSL](https://learn.microsoft.com/en-us/windows/wsl/install) and [manual WSL steps](https://learn.microsoft.com/en-us/windows/wsl/install-manual).
  </Step>
</Steps>

### Configure Launch in browser

<Info>
  **In SaaS only:** this functionality is off by default and is enabled on request — contact your Syteca vendor or the Support team.
</Info>

<Steps>
  <Step title="Sign in with the right permissions">
    Sign in as a user with both the **Privileged Accounts Management** and **Tenant Management and System Configuration** administrative permissions.
  </Step>

  <Step title="Sign in with the right permissions">
    Sign in as a user with both the **Privileged Accounts Management** and **Tenant Management and System Configuration** administrative permissions.
  </Step>

  <Step title="Open the Web Connection Manager tab">
    Click the **Cog** icon (top right) to open **Configuration**, then select the **Web Connection Manager** tab.

    <Note>
      This tab appears only if the Password Management (PAM) toggle is enabled in the [license serial key](/docs/administration/licensing/overview#what-a-serial-key-contains).
    </Note>
  </Step>

  <Step title="Open the Web Connection Manager tab">
    Click the **Cog** icon (top right) to open **Configuration**, then select the **Web Connection Manager** tab.

    <Note>
      This tab appears only if the Password Management (PAM) toggle is enabled in the [license serial key](/docs/administration/licensing/overview#what-a-serial-key-contains).
    </Note>
  </Step>

  <Step title="Enable and configure">
    Move **Enable Syteca Web Connection Manager** to the right (only possible once WSL and Hyper-V are installed). Then either keep **Use an auto-created trusted self-signed certificate** selected (the default), or upload a custom certificate and private key. Enter the **Port** for Apache Guacamole (default `4822`).
  </Step>

  <Step title="Validate and set up">
    Click **Validate and Set Up**. Syteca checks for and installs Apache Guacamole if needed, validates the parameters, and saves them. Wait for the **Validation Results**.

    <Note>
      In High-Availability mode, click **Validate and Set Up** in each Management Tool (on each node).
    </Note>
  </Step>

  <Step title="Adjust resource optimization (optional)">
    In **Browser Connection Settings**, optionally disable **Resource Optimization Mode** (on by default; it reduces visual effects for stability), then click **Save**.

    <Note>
      In Multi-Tenant mode, these settings apply to all tenants and can only be enabled by a user of the built-in default tenant.
    </Note>
  </Step>
</Steps>

<AccordionGroup>
  <Accordion title="Validation error messages and fixes">
    If setup fails, the **Validation Results** pop-up shows one of:

    * **The certificate or private key is invalid or not supported** — import a valid certificate (and private key, if used).
    * **Port \<4822> is in use by another application** — free that port or enter a different one.
    * **Insufficient disk space available for Web Connection Manager installation** — at least **220 MB** free is required.
    * **The required Windows features for WSL are not enabled** — install the WSL feature and Hyper-V role.
    * **The latest version of WSL is required. Please upgrade WSL.** — upgrade WSL to version 2 or higher.
    * **An unknown error occurred.** — any other cause.
  </Accordion>
</AccordionGroup>

## Use secrets in Web Connection Manager

To connect, sign in with a PAM seat license, hover over a secret on the **Password Management** page, click **Launch**, and choose **Launch locally** or **Launch in browser**.

The same per-secret options available in the [Desktop Connection Manager](/docs/pam/secrets/use-secrets) are available here — [view and copy password](/docs/pam/secrets/view-copy-password), the [Details column](/docs/pam/secrets/view-manage-secrets) status, and [file transfer](/docs/pam/secrets/file-transfer). For working with the secrets grid and folders, see [View and manage secrets](/docs/pam/secrets/view-manage-secrets).

<Note>
  After you confirm your account password once, you can view or copy it without re-entering it for a **5-minute** grace period (applies to both **Connection Manager** and the **Management Tool**).
</Note>

## Related

<CardGroup cols={2}>
  <Card title="Desktop Connection Manager" icon="monitor" href="/docs/pam/access/desktop-connection-manager">
    The Windows Client / jump server alternative.
  </Card>

  <Card title="Connect using a secret" icon="plug-zap" href="/docs/pam/secrets/use-secrets">
    Step-by-step connection for each secret type.
  </Card>

  <Card title="View and manage secrets" icon="folder-tree" href="/docs/pam/secrets/view-manage-secrets">
    Work with the secrets grid and folders.
  </Card>

  <Card title="Set up Password Management" icon="sliders-horizontal" href="/docs/pam/secrets/configure-password-management">
    The full PAM configuration order.
  </Card>
</CardGroup>