Locate the system that is being sent a PSM session request at the System Management page (/tpam/ManageSystems.asp), click "Accounts" button, then check the "PSM Enabled" column on the Account Management page to verify if PSM has been enabled for the accounts on the system. For any account with PSM enabled, please go to the Details tab to check if "Ignore System Access Policies" has been ticked.
This can happen if the PSM is enabled on the system but the account discovery template has PSM enabled . It is possible that the servers were discovered before the account discovery profile was created. To set the PSM to "enabled" on the systems that were pulled into TPAM before the Account Discovery Profile was in effect, use batch processing to set these systems to enabled. Then any new servers would be PSM enabled on discovery. Please review the Batch Processing chapter in the TPAM Administration Guide.