> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/pam/knowledge-base/troubleshooting-articles/action-scripts-troubleshoot-in-devolutions-server.md).

# Action scripts troubleshoot in Devolutions Server

When [action scripts](https://docs.devolutions.net/pam/kb/knowledge-base/create-anyidentity-action-script-dvls/) fail within custom PAM providers, it is essential to understand how to identify and troubleshoot the issue. Multiple issues can arise with a custom PAM provider due to the various steps involved. Additionally, custom PAM providers heavily rely on action scripts for functionality, and depending on the complexity of the identity provider, these action scripts can become intricate.

Problems may occur if the provider is not thoroughly tested beforehand. The following guidelines will help identify potential issues and provide steps for troubleshooting.

### 1. Identify the problem

The problem may not always be immediately apparent. While the action scripts may function correctly in isolation, custom PAM providers may not apply password changes as expected. For instance, if the action scripts are incorrectly built and return inaccurate information, custom PAM providers may use this information to make decisions, assuming everything is functioning properly when it is not.

In some cases, the issue may be more obvious, such as seeing an "Out of sync" warning message for the user in the Devolutions PAM vault or noticing a problem in the [PAM logs](https://docs.devolutions.net/pam/server/pam-reports).

### 2. Identify the action script involved

Since custom PAM providers operate primarily as a script orchestrator, the majority of its functionality depends on the action scripts. If an error appears in the Devolutions Server console, it is important to first identify which action script is involved. This requires an understanding of how custom PAM providers *map* functionality to the action scripts through its terminology.

* Account discovery configuration: Account discovery configurations use the account discovery action script.
* Synchronization: Custom PAM providers use the term "synchronization" to refer to running the heartbeat action script.
* Password reset: Initiating a password reset in custom PAM providers involves both the password rotation and heartbeat action scripts.

### 3. Test action scripts outside of custom PAM providers.

After identifying the action scripts involved, it is advisable to test them outside of custom PAM providers to ensure that the issue does not originate from the action script itself. The same parameters defined via Script Parameters when creating the template should be passed to the script. It is crucial to verify that the PowerShell script returns the expected results for custom PAM providers:

* Account discovery: Should output at least one `pscustomobject` object with `id`, `username`, and `secret` properties.
* Heartbeat: Should have `username` and `secret` parameters and return a single boolean value, either `$true` or `$false`.
* Password rotation: Should include parameters for the identity provider endpoint, endpoint username, endpoint password, and a specifically named parameter called `NewPassword`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.devolutions.net/pam/knowledge-base/troubleshooting-articles/action-scripts-troubleshoot-in-devolutions-server.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.