I followed the steps outlined in this article.

/cyberres/pam/f/pam_discussions/206847/pam-rdp-error

But RDP Relay for Submit User still doesn't work for me. I have created an LDAP eDirectory with an admin account. I don't understand what it means to create an empty LDAP account. My rule is as follows

 i am using pam 3.7

1. From the screenshots, I see that you have configured an eDirectory LDAP Server and are using this in the command control rule to authorize access for the user. This is suggesting to me that you are intending to login as an eDirectory LDAP User 'test' and then want to receive access to the Windows domain server as this same 'test' edirectory user. In this case, Windows won't be able to authenticate 'idm\test' because that user does not exist or cannot be authenticated within the Windows domain environment. You could, however, provide privileged elevation through a command control rule where the 'test' credential exists within the Windows Resource of the PAM Vault and also the Windows domain can authenticate it.
   
   
2. PAM does not currently have 'Submit User' as 'Run User' support for Windows RDP Relay; however, there is support for this use-case in the Direct RDP approach. For more details about this use-case, please refer to documentation: see Direct Remote Desktop Protocol. This use-case you could login directly to the Windows server as 'test' where it is authenticated by the Windows domain and you receive access with the same privilege/credentials as 'test' user, but receive the benefit of having an audited session from PAM.