When a user initiates a Privileged Session Manager (PSM) connection, the Password Vault Web Access (PVWA) generates a signed RDP file. The user's client machine uses this file to establish a Remote Desktop Protocol (RDP) connection directly to the PSM server. This initial connection authenticates to the PSM server using a predefined, low-privileged local user. The default user created during PSM installation for this specific purpose is PSMConnect. This user has just enough permissions to log on to the PSM server via RDP and launch the session components, but is otherwise highly restricted to ensure the security of the PSM server itself.

A. Credentials stored in the Vault for the target machine: These credentials are used in the second leg of the connection, from the PSM server to the final target machine, not from the user's client to the PSM server.

B. Shadowuser: A Shadow User is a privileged user who can monitor or join an already active PSM session. It is not used for initiating the RDP connection to the PSM server.

D. PSMAdminConnect: This is a separate, more privileged local user on the PSM server, intended for administrators to perform maintenance tasks on the PSM server, not for regular end-user sessions.

1. CyberArk Privileged Access Manager Documentation

Version 12.6

"Privileged Session Manager > Install PSM > PSM users and groups". This section explicitly states: "During PSM installation

the following local users are created on the PSM Server machine... PSMConnect - A low-privileged user that is used to connect to the PSM server."

2. CyberArk Privileged Access Manager Documentation

Version 12.6

"Privileged Session Manager > PSM Architecture > PSM connection flow". The documentation describes the connection flow where the end user's RDP client connects to the PSM machine. The user for this connection is specified in the RDP file

which by default is PSMConnect.

3. CyberArk Privileged Access Manager Documentation

Version 12.6

"Privileged Session Manager > Administration > Secure the PSM Server > PSM Hardening". The hardening guide details the limited permissions assigned to the PSMConnect user

reinforcing its role as the logon account for end-user sessions to the PSM server

distinct from administrative accounts like PSMAdminConnect.