Issue: Configuring SSO to any application requires the administrator to add SSOUSER (This is default user name and it can be changed according to your preference) in Active Directory for the RDS session, publishing applications and so on. It is required for the SSOUSER to be included to the domain admin group. However, the administrator can allow SSOUSER to access Application SSO sessions without including users to the Domain Admins group.
Workaround: To provide least privilege to SSOUSER that is necessary, perform the following, perform the following:
Do not include the domain controller part of the AppSSO agent.
Add SSOUSER as part of the Domain user and Remote Desktop User.
In domain controller, add SSOUSER to the Domain Users group.
In the session hosts under Remote settings, disable Allow connections only from computers running Remote Desktop with Network Level Authentication.
Under Remote settings, click Select Users and add SSOUSER to the list which can connect to the machine remotely.
As SSOUSER is not part of any administrator group, publishing applications through PAM is not possible. Microsoft RDS does not allow domain users to publish applications. Therefore, the application needs to be published by the appropriate user (domain admin users) and added to the PAM credential vault with the Publish Remote Application set to Already Published option.
PAM uses Run as a privilege user policy as part of the AppSSO feature. For this, SSOUSER needs to be part of the Allow log on locally group policy. This must be done for all the session hosts that are AppSSO agent as well.
Run the Local Group Policy Editor (gpedit.msc).
Navigate to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
Locate Allow log on locally parameter and open its settings.
Click Add User or Group, and add the SSOUSER to the list.