Skip to main content

​
Agentless privileged access, from the browser

Syteca Web Connection Manager is agentless PAM: your team brokers connections to privileged Windows, Linux, and Active Directory accounts directly from a browser, with no software installed on the user’s machine. Traditional PAM gateways require a Syteca Client on every endpoint that users connect from, which is fine for office workstations but slow and painful for contractors, BYOD users, remote staff, and short-notice incident response. Web Connection Manager removes that friction: any computer with Microsoft Edge or Google Chrome can launch a brokered session in seconds, using the same secrets and permissions your team already manages.
Choose Web Connection Manager when you need to:
  • Onboard contractors or third-party admins quickly, without IT touching their devices.
  • Give remote or BYOD users privileged access without deploying agents.
  • Stand up break-glass / incident-response access from any computer.
  • Eliminate the cost of installing and updating Clients on every workstation.
Prefer the Desktop Connection Manager when you need full session recording, which is currently only available with a local Syteca Client.
This page covers both launch modes — Launch in browser (agentless, no recording) and Launch locally (with Syteca Client, recording supported) — and the setup steps for each.
Web Connection Manager Launch menu with both launch options

The Launch menu in Web Connection Manager, with Launch locally and Launch in browser.

​
The two launch modes at a glance

​
Supported secret types

Launch in browser is not available if Record user activity while the secret is in use is enabled on the secret, because browser launches cannot be recorded.

​
Launch locally

​
Prerequisites

If recording is required, enable Record user activity while the secret is in use on each relevant secret. These third-party applications must be installed on the computer where the Management Tool is used:

​
Install the Syteca Client for local launch

The Client must be installed in a specific way for Launch locally to work.
1

Sign in with a PAM seat license

Sign in to the Management Tool as a user with a PAM seat license and any administrative permission.
2

Sign in with a PAM seat license

Sign in to the Management Tool as a user with a PAM seat license and any administrative permission.
3

Open the Launch menu

Hover over a secret you have permission to use, click Launch in the floating bar, and select Launch locally.
4

Download the Client

On the page that opens in a new tab, if the Client isn’t yet installed this way, click Download Syteca Client, then install it.
If the Client was previously installed on this computer but not via the Download Syteca Client button, re-install it using that button. You do not need to uninstall or delete it in the Management Tool first.
5

Confirm the PAM Clients group

After install, the Client is automatically added to the default PAM Clients group.
The PAM Clients group is used only for the Launch locally option and allows recording (when enabled on the secret). Clients in it can’t be added to other groups and can only be removed by uninstalling and then deleting them on the Clients page. The group itself can’t be deleted.

​
Launch in browser

​
Prerequisites

  • Supported browsers: Microsoft Edge and Google Chrome.
  • The Management Tool computer must run Windows Server 2022 or higher.
  • Plan for 1 CPU core and 2 GB RAM per 25 secrets launched concurrently in the browser, on the Management Tool computer.
  • The Windows Subsystem for Linux (WSL) feature and Hyper-V role must be installed on the Management Tool computer.
1

Install WSL and Hyper-V

Use Windows Server Manager to install the WSL feature and Hyper-V role, then restart the Application Server computer.
2

Upgrade to WSL 2 (Windows Server 2025 only)

On Windows Server 2025, install WSL version 2 (enable the Virtual Machine Platform feature first), then restart again. See Install WSL and manual WSL steps.

​
Configure Launch in browser

In SaaS only: this functionality is off by default and is enabled on request — contact your Syteca vendor or the Support team.
1

Sign in with the right permissions

Sign in as a user with both the Privileged Accounts Management and Tenant Management and System Configuration administrative permissions.
2

Sign in with the right permissions

Sign in as a user with both the Privileged Accounts Management and Tenant Management and System Configuration administrative permissions.
3

Open the Web Connection Manager tab

Click the Cog icon (top right) to open Configuration, then select the Web Connection Manager tab.
This tab appears only if the Password Management (PAM) toggle is enabled in the license serial key.
4

Open the Web Connection Manager tab

Click the Cog icon (top right) to open Configuration, then select the Web Connection Manager tab.
This tab appears only if the Password Management (PAM) toggle is enabled in the license serial key.
5

Enable and configure

Move Enable Syteca Web Connection Manager to the right (only possible once WSL and Hyper-V are installed). Then either keep Use an auto-created trusted self-signed certificate selected (the default), or upload a custom certificate and private key. Enter the Port for Apache Guacamole (default 4822).
6

Validate and set up

Click Validate and Set Up. Syteca checks for and installs Apache Guacamole if needed, validates the parameters, and saves them. Wait for the Validation Results.
In High-Availability mode, click Validate and Set Up in each Management Tool (on each node).
7

Adjust resource optimization (optional)

In Browser Connection Settings, optionally disable Resource Optimization Mode (on by default; it reduces visual effects for stability), then click Save.
In Multi-Tenant mode, these settings apply to all tenants and can only be enabled by a user of the built-in default tenant.
If setup fails, the Validation Results pop-up shows one of:
  • The certificate or private key is invalid or not supported — import a valid certificate (and private key, if used).
  • Port <4822> is in use by another application — free that port or enter a different one.
  • Insufficient disk space available for Web Connection Manager installation — at least 220 MB free is required.
  • The required Windows features for WSL are not enabled — install the WSL feature and Hyper-V role.
  • The latest version of WSL is required. Please upgrade WSL. — upgrade WSL to version 2 or higher.
  • An unknown error occurred. — any other cause.

​
Use secrets in Web Connection Manager

To connect, sign in with a PAM seat license, hover over a secret on the Password Management page, click Launch, and choose Launch locally or Launch in browser. The same per-secret options available in the Desktop Connection Manager are available here — view and copy password, the Details column status, and file transfer. For working with the secrets grid and folders, see View and manage secrets.
After you confirm your account password once, you can view or copy it without re-entering it for a 5-minute grace period (applies to both Connection Manager and the Management Tool).

Desktop Connection Manager

The Windows Client / jump server alternative.

Connect using a secret

Step-by-step connection for each secret type.

View and manage secrets

Work with the secrets grid and folders.

Set up Password Management

The full PAM configuration order.