> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/knowledge-base/troubleshooting-articles/action-scripts-troubleshoot-in-devolutions-server.md). # Action scripts troubleshoot in Devolutions Server Diagnose failing action scripts in Devolutions Server custom PAM providers by identifying the issue, mapping it to the right script, and testing outputs. When [action scripts](/pam/knowledge-base/knowledge-base-articles/custom-pam-provider-action-scripts-in-devolutions-server.md) fail within custom PAM providers, it is essential to understand how to identify and troubleshoot the issue. Multiple issues can arise with a custom PAM provider due to the various steps involved. Additionally, custom PAM providers heavily rely on action scripts for functionality, and depending on the complexity of the identity provider, these action scripts can become intricate. Problems may occur if the provider is not thoroughly tested beforehand. The following guidelines will help identify potential issues and provide steps for troubleshooting. ### 1. Identify the problem The problem may not always be immediately apparent. While the action scripts may function correctly in isolation, custom PAM providers may not apply password changes as expected. For instance, if the action scripts are incorrectly built and return inaccurate information, custom PAM providers may use this information to make decisions, assuming everything is functioning properly when it is not. In some cases, the issue may be more obvious, such as seeing an "Out of sync" warning message for the user in the Devolutions PAM vault or noticing a problem in the [PAM logs](/pam/pam-with-devolutions-server/pam-reports-in-devolutions-server.md). ### 2. Identify the action script involved Since custom PAM providers operate primarily as a script orchestrator, the majority of its functionality depends on the action scripts. If an error appears in the Devolutions Server console, it is important to first identify which action script is involved. This requires an understanding of how custom PAM providers *map* functionality to the action scripts through its terminology. * Account discovery configuration: Account discovery configurations use the account discovery action script. * Synchronization: Custom PAM providers use the term "synchronization" to refer to running the heartbeat action script. * Password reset: Initiating a password reset in custom PAM providers involves both the password rotation and heartbeat action scripts. ### 3. Test action scripts outside of custom PAM providers. After identifying the action scripts involved, it is advisable to test them outside of custom PAM providers to ensure that the issue does not originate from the action script itself. The same parameters defined via Script Parameters when creating the template should be passed to the script. It is crucial to verify that the PowerShell script returns the expected results for custom PAM providers: * Account discovery: Should output at least one `pscustomobject` object with `id`, `username`, and `secret` properties. * Heartbeat: Should have `username` and `secret` parameters and return a single boolean value, either `$true` or `$false`. * Password rotation: Should include parameters for the identity provider endpoint, endpoint username, endpoint password, and a specifically named parameter called `NewPassword`. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.devolutions.net/pam/knowledge-base/troubleshooting-articles/action-scripts-troubleshoot-in-devolutions-server.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.