Hello,
Please see this article
https://ca-broadcom.wolkenservicedesk.com/external/article?articleId=17076
Basically CA PAM is NOT compatible with the restrictions imposed on user accounts from the Protected Users group.
Best Regards,
Andreas