If Windows AppLocker is enabled on the PSM server, you must ensure that psminitsession.exe is included in the "Allow" rules. CyberArk provides a hardening script that usually automates this.
: The PSMConnect and PSMAdminConnect users require Read & Execute permissions on the executable and its parent folder. psminitsessionexe