The PATROL Event Manager Console uses different accounts depending upon how it is started.
The PATROL Event Manager Console is accessed through the PATROL Console and it shares the console's connection to the agent. If the console can connect to the agent, the ACL cannot prevent the Event Manager Console from receiving events.
The PATROL Event Manager Console is built into the PATROL Developer Console for Windows. The PEM Console does not establish a separate connection with the agent and is not affected by ACL entries that contain the PEM access mode (P).
When the PATROL Event Manager Console uses the PATROL console's connection to the agent, it does not register as a PEM application and is therefore not affected by the PEM mode in an ACL entry.
When the PATROL Event Manager Console is started from the command line as a separate process, independent of the console, the PEM Console uses the OS logon account. When started from the command line, you can restrict its access to the agent by excluding the PEM mode value from ACL entry.
The PATROL Event Manager Console application cannot be started from the command line. The application is built into the PATROL Console for Windows.