Enrolling the PAM agent on a host
There is no PAM-branded install screen. The enrolment token comes from the XDR endpoints dialog, one product option among several, on a host that needs rotation done locally.
Rotation and discovery for a local Windows or Linux account happen on the host, not by Qorionix reaching in remotely — there is no route from the platform into your on-premise network and no SSH client baked into it. That work is done by a small, separate binary called the PAM agent, and the place you generate its install token is not obviously a PAM screen at all: it is the same Add endpoint dialog XDR uses for the sensor, on the Endpoints screen, with a Product dropdown you have to notice.
How to enrol one
Open Endpoints and choose Add endpoint
The same dialog used for the XDR sensor. Give the token a label you will recognise later — “Head office laptops” is the kind of thing this is for.
Set Product to PAM agent
This is the field that decides which install command you get. Left on the default, you get an XDR sensor token instead, which will not do anything for privileged-account rotation.
Choose Platform: Windows or Linux
The PAM agent's local-account operations are built for these two. On Windows it goes through the OS APIs directly rather than WinRM; on Linux it edits
/etc/passwd,/etc/shadowand/etc/sudoersthrough the standard tools.Set Maximum uses and Expires after, then Create token
An expiry is mandatory and 90 days is the ceiling — a long-lived reusable token is the kind that ends up pasted into a group-policy script and never rotated again.
Copy the token immediately — it is shown once
The server keeps only a hash of it. If you close the dialog before copying, revoke this token and create another; there is no way to retrieve the value afterwards. See One-time secrets.
Run the generated install command on the host
It calls
enroll --token --api --configunder the hood, redeems the coupon, and holds a per-machine credential from then on. Treat the command itself as containing a password, because it does.
What the agent actually does, once it is on the host
| Capability | What it does |
|---|---|
| Enrol | Redeems the token and holds a per-machine credential for everything below. |
| Inventory | Enumerates this host's privileged local accounts and reports them — the only way Discovering privileged accounts can see an on-premise host, since the platform has no network route to reach one itself. |
| Rotate | Changes a local account's password through the operating system and verifies the new one actually works before reporting success. A rotation that cannot be verified is reported as a failure and the old secret is kept, rather than storing an unproven one. |
| Elevate | Applies a time-boxed privileged right and removes it again when the window closes, using a lease written to the host's own disk — so the right still expires even if the host loses contact with the platform. |
What to do next
- Read Enrolment tokens for what the expiry and maximum-uses fields actually enforce — the mechanics are shared with the XDR sensor token.
- Once a host reports in, read Discovering privileged accounts to see what it found.
- Read Rotating Active Directory and Windows credentials or Rotating Linux SSH credentials for which target types this agent's rotation actually covers.