In short: for the Puppet Windows Agent.
The program invokes CyberArk Shadow Users ( PSMShadowUsers ), ensuring that the primary administrative account credentials remain separated from the user’s interactive space.
[User Browser / PVWA] ➔ [RDP File Download] ➔ [PSM Gateway Server] │ (Windows Logon Event) │ [PSMInitSession.exe] ◄── (Intercepts Shell) │ [PSM Client Dispatcher] │ [Target System] psminitsessionexe
Puppet needs to:
user logs into a PSM server. Its primary role is to bridge the gap between the initial login and the actual target application (e.g., a SSH client, web browser, or management console). If this executable fails to run, the entire privileged session will fail to start, often resulting in an error message stating: "This initial program cannot be started" 2. Core Functionality Startup Trigger: It is configured as the startup program for the PSMConnect (and sometimes PSMAdminConnect ) user accounts. Session Handover: In short: for the Puppet Windows Agent
Puppet operates using a master-agent architecture. On Unix/Linux systems, Puppet agents run as daemons. On Windows, Puppet requires additional helper processes to manage sessions, user contexts, and permissions—this is where psminitsessionexe enters the picture.
Failures associated with this process often manifest as the following error codes: Error Code Common Cause Its primary role is to bridge the gap
: Instead of rendering a standard Windows desktop shell (like explorer.exe ), Remote Desktop Services (RDS) is hardcoded to run PSMInitSession.exe as the initial initialization payload.