Privileged Account Manager
Access Denied error appears when attempting to Run as privileged user and launch a Credential Provider rdp session.
While there may be many reasons for Command Control (cmdctrl) to deny any particular authorization request, please verify that the Run Host is either set to Submit Host or configured to match the Agent Name found in the Hosts Console. The Run Host configured in the cmdctrl rule must match the Agent Name for authorization to be approved.
Agent Name and Run Host mismatch.