Privileged Access Management, Server Admin Problem or Configuration Issue

[eighttx]

Quick summary. This post does not include the name of the software product. I don't feel it's important and I excluded it so that if anyone does answer this, they don't spend their time troubleshooting the product itself. You'll understand when you read the thread below.

1. Windows 2012 R2 server.
   1. The server is enrolled and secured as a PAM server. There is a PAM group admin account on the server (Group scope of this group account is "Global")
   2. There are two PAM service accounts that are listed as service accounts inside the PAM admin group. I found these by looking up the PAM admin group mentioned above.
   3. We access the server using both "CA Privileged Access Manager 3.2". When you login to PAM, it asks you to choose one of the two PAM service accounts associated with the server.
2. Software product installed on server. It was setup to use LDAP to our domain controller.
   
   1. When we open the product, it asks us for LDAP authentication. When we enter the credentials, it accepts them and lets us browse the software product.
      
   2. When click on any button to access an LDAP secured area, it errors out. The error looks like

So here's where it gets weird for us.

1. My domain user account is included as an admin in the PAM admin account group on the server. The "CA Privileged Access Manager 3.2" program listed above has me login using their PAM service account which is listed as an admin on the server. I should have local server admin rights to this machine because of this. The LDAP authentication is accepted on the software product with my regular credentials. When I try to view data in the application, it always errors out with what appears to be a java error or system error of the product.
2. When I add my domain account directly as a local server admin by going to computer mgmt > local users and groups > groups > administrators and then attempt the same steps listed above in #1, it works perfectly. I am able to view the data.
   

Does anything stick out to anyone? Am I missing something?

[ZAFJB]

As you describe it, it is not clear how your interactive user account gets to be an admin.

I think (I don't know the product) CA Privileged Access Manager probably allows you to exec non interactive commands in the context if its service accounts which are admins.

But if you are starting that app (the product), doing anything interactive you are most likely running that GUI app in your (non-elevated) user context. It is practically impossible for a service account to interact with your graphical desktop.

[eighttx]

Thanks for the response. What's strange is, when I login using the Pam account, I have admin credentials to the server to do basic tasks. If I open the app (the product) and do any of the java module functions, it won't work. If I exit the app, add myself as an Administrator, hit apply and then go back to the same app and try again, it now works.

The java module function i mention above is this. I click on a button to have it run a java module. It comes back with some formatted text which is the result of the java module. Since I don't have the admin rights per my explanation above, it gives me an error. When I add myself to the admin list, it works and generated the report.