Skip to main content

Events
Groups
BeyondTrust University
Support Portal
Ideas Portal (Aha!)
BeyondTrust.com

Read our latest Customer Success Newsletters in the BeeKeeper Community!

Welcome to the BeyondTrust BeeKeepers Community!

Ask questions, get answers and engage with your peers

773 Topics
1,551 Replies
2,671 Members

Community

Start discussions, ask questions, get answers

Events

Explore and RSVP for upcoming events

Groups

Connect with like-minded professionals

Product Updates

Read the latest news from our product team

Featured topics

The latest & greatest from BeyondTrust

Recent activity
Help others
Categories

AdamSaNewcomer

Windows & MacOS

Best Practices of application policies - macOS

Hello! First time poster here, hope everyone’s doing well.I have a couple of questions regarding the macOS application policies, hopefully someone can lend me a hand and help out :) My BT EPM for Mac is currently set to ‘listening mode’ - it reports back on our users application usage [what’s installed, what’s opened, what’s being used etc.]. I want to use it to create policies on applications that should be ‘allowed’ or ‘disallowed’ based on different factors. The questions are as follows:When adding a policy based on a reported application, the in-built ‘add to policy’ button gives me two automatically assigned arguments: URI and Publisher. Could someone explain, what an URI is? Is it ok to use that as an argument regarding if an application should be allowed for usage? My first though was that it’s the applications unique ID - the bundle ID - but that’s not it after further insight. Is there a way to have an argument that uses the Bundle ID of an application? for example: com.micros

The Fabulous Leon RobinsonBeyondTrust Employee

Launch of Education Subscription Podcast: 'OneSecBeyond'

In the education team we’re always looking for new avenues to help inform our product users on topics associated with what we deliver. As classroom teaching can be quite proscriptive we've kicked off a podcast series where we can expand and discuss topics related to the core interest of security and the training on the products we deliver.The first three episodes are available now for education subscription customers at https://university.beyondtrust.com/pages/54/podcasts

BartoszApprentice

More granular access rights for custom PS Admin roles

Hello everyone,We’re struggling with lack of possibility to introduce more granular access for PS Administrators, there’s an idea for the same More granular access rights for custom PS | All Product Ideas - Public Do you have similar experience with the product? If yes then please share your thoughts on that and like an idea if you find it useful, maybe it will get some attention thanks to that.Cheers,Bartosz

tsipesNewcomer

Accessing SRA API

This may have been asked already. I have been working in the APIs for PWS with no issue. Moving over to SRA, I cannot get the connection to work. Tells me it is not allowed. I have the account and API client/secret encoded. I am using Powershell and tried it with/without the -Method POST option. My code is $AuthKey = "Basic MyBase64Key"$AuthURI = "https://OURSITE.beyondtrustcloud.com/oauth2/token"$headers = @{ Authorization=$AuthKey}$Response = Invoke-RestMethod -URI $AuthURI -Header $headersWhat in the name of the sake of sanity am I missing? Once I get this I know the rest falls into place. TIA

BartoszApprentice

ESA deployment requirements

Hello community,I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one?I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment.Cheers,Bartosz

ChaseApprentice

Windows & MacOS

EndpointUtility.exe and Trellix

Our company utilizes a full Trellix stack of products (unfortunately) in addition to Endpoint Privilege Management. We have recently upgraded from our On-Prem ePO managed Privilege Management solution to the new SaaS PMC. One thing we have learned is that when using the EndpointUtility.exe tool to gather logs, is that the Endpoint Utility wants to grab all of the McAfee ProgramData logs even though we have just finished fully migrating over from on-prem ePO managed to SaaS.It seems Trellix Self-Protection is causing a permissions error at the very end of the log capturing process. After working with support and confirming there is no CLI available in this tool, we are basically forced to disable all of self-protect in order to gather logs, McAfee logs at that, that aren’t even necessary.Making this post as a means to communicate our findings in case others coming from on-prem ePO to SaaS experience this problem. It would be extremely beneficial if there were baked in CLI arguments t

bt101Veteran

Windows & MacOS

access denied error while installing dinocapture app

Hello, I am seeing access denied error while installing below app. The policy allows child processes with Full Admin token. In EPM Analytics I see that child processes are getting the token assigned. https://www.dinolite.us/download/ Dinocapture 2.0 In Process Explorer it shows only 4 child processes. These are getting Full Admin assigned per PMC logs.I couldn’t see any processes accessing the said files from error screenshot when checked in handle.exe.Attaching the logs , in case anyone has seen similar errors in other apps and got any pointers to troubleshoot further. The install works fine with local admin user.

Robert A.Apprentice

Securing default generic accounts (bt/bi/bu-admin)

Hi,I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging.I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This would only cover the

BartoszApprentice

Additional TOTP step for federated authentication

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Additional TOTP step for federated | All Product Ideas - Public it’s not possible to use TOTP when federated authentication to Password Safe is enabled.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Bartosz

AndyHTrailblazer

Questions Regarding PRA Failover Implementation

Hello,I am currently implementing PRA failover using the guide available at BeyondTrust PRA Failover Documentation, and I have a few questions that I hope you can help with: I’ve attached our network diagram. Based on the failover guide, it seems that the only applicable method for our setup is DNS Swing. This is because the two appliances are located in separate data centers with different IP schemas, making the Shared IP method unfeasible. Additionally, since the data centers have different public IP addresses, NAT Swing would not work either. Could you please confirm if my understanding is correct? Regarding DNS Swing: When the primary PRA fails, do I need to manually log in to the DNS server and update the domain name to point to the backup PRA's public IP address? Do I also need to log in to the backup PRA to change its role to primary, and conversely, log in to the original primary PRA (once recovered) to switch its role to backup? The guide mentions the following no

tsipesNewcomer

Accessing SRA API

This may have been asked already. I have been working in the APIs for PWS with no issue. Moving over to SRA, I cannot get the connection to work. Tells me it is not allowed. I have the account and API client/secret encoded. I am using Powershell and tried it with/without the -Method POST option. My code is $AuthKey = "Basic MyBase64Key"$AuthURI = "https://OURSITE.beyondtrustcloud.com/oauth2/token"$headers = @{ Authorization=$AuthKey}$Response = Invoke-RestMethod -URI $AuthURI -Header $headersWhat in the name of the sake of sanity am I missing? Once I get this I know the rest falls into place. TIA

BartoszApprentice

ESA deployment requirements

Hello community,I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one?I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment.Cheers,Bartosz

Robert A.Apprentice

Securing default generic accounts (bt/bi/bu-admin)

Hi,I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging.I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This would only cover the

Windows & MacOS

Issues with elevating MSI's

Hello, I can start with saying that we do have a support case open at the moment. But just curious is anyone else has encountered this. After updating to 25.2.11 some MSI’s fail directly after launch or mid through the installations. They get errors like these:2738, Could not access VBScript run time for custom action [2]. 2739, Could not access JScript run time for custom action [2].to solve this one should run regsvr32 jscript.dll or regsvr32 VBScript.dll however after installing 25.2.11 we are no longer able to edit HKEY_CURRENT_USER\Software\Classes\CLSID\{Any CLSID Folder}.If I downgrade BTPM towards 23.9.261.0 the MSI’s does not fail and im able to read the content of HKEY_CURRENT_USER\Software\Classes\CLSID\{Any CLSID Folder}.regardsMichael

ArnoNewcomer

Enhance performance for PRA

Hi Community,Is there any experience that latency times increase as longer as a PRA appliance runs?Subjectively, we have the impression that the PRA connection is getting slower, even within the sessions.Are there ways of measuring this objectively?What can be done to improve it? More RAM in the jump points or something similar? RegardsArno

suhail.salimNewcomer

Change AD user status from active to inactive/disabled

Hi All,We have AD users in password safe who are quarantined and form login disabled. The users are no longer in organizations. The group we created to onboard these users are also disabled/deleted. The access revoke method used by earlier admins were incorrect and they removed the group from password before syncing them. Is there a way we can make these users status as inactive?

Didla DheerajNewcomer

Enhance the disco scans so they don't generate the false-positive logon events

Hi All,When the Password Safe Detailed Discovery Scan runs against a Windows server, the BTExecService agent deployed on the scanned server enumerates the members of all local admin groups, so these can eventually be onboarded and managed by Password Safe. We have observed that Group Memberships for each enumerated account are also checked. This enumeration process is causing the LastLogonTimeStamp for the enumerated accounts to be updated, generating logon events attributed to the Discovery Scan agent BTExecExt.Phoenix.exe, even though no actual logon operation took place.In fact, according to the Microsoft article below, the LastLogonTimeStamp attribute can be updated and trigger a logon event even if the user has not logged on. This behaviour is an artifact of a Kerberos operation known as Service-for-User-to-Self (S4u2Self), in which a client/service can request a ticket for a user that is only useful for things like determining Access Checks or Group Membership.https://techcommuni

Didla DheerajNewcomer

Native web application support in PAM

Hi All,Currently it's not possible to add a webbrowser application native in BeyondInsight Password Safe and inject the privileged/managed account credentials, without RDP/RDS server integration. Please add the option to: Add a (web)application page and inject the privileged/managed account credentials Add a rotate option, using an API functional account with custom API scripting/calls. Best regards,Dheeraj.

tsipesNewcomer

API /Secrets-Safe/Secrets returns no data

We recently upgrade to 24.3 and now we have a reporting issue. Using the API /Secrets-Safe/Secrets with a GET returned all the secrets stored. Now, it returns nothing. Other API calls to other endpoints work with no problem. This is a SOX reporting issue now. I have opened a ticket but thought I would try here to see if anyone had any thoughts. Other than the software upgrade, nothing else has changed. TIA

SathishNewcomer

how to setup email notifications to the service account owners once the password is rotated in password safe

We have the following use case: Onboard the service account to password safeNotify the service account owners with the new password when the password is rotated in password safe. The password need to be communicated to the service account owners for any external service account usage beyond password safe The service account password should be updated by the password safe on the underlying windows services/scheduled tasks/ IIS application pools.I would like to understand the feasibility on the email notifications, password updates on the services and any challenges that anyone faced while onboarding the service accounts.

General Topics

Everything you need to know about this community

Buzz Board

24 topics

Community News

5 topics

Company News

2 topics

Security Research

A dedicate space to talk about Security Research.

General

12 topics

Identity Security

1 topic

Endpoint Security

3 topics

Network and Remote Access Security

1 topic

Industry Trends

This is a place to share what you are seeing in the industry.

Identity Access Management

1 topic

Secrets and Non Human Identities

0 topics

AI and Machine Learning

1 topic

Compliance, Regulation and Frameworks

0 topics

Cloud and SaaS

1 topic

Threat Landscape

1 topic

Operation Technologies (OT)

0 topics

Other

1 topic

Active Directory (AD) Bridge

Achieve streamlined identity management and access control by extending Microsoft AD authentication, SSO capabilities, and Group Policy configuration management to Unix and Linux systems.

General

13 topics

Endpoint Privilege Management

Enforce least privilege dynamically to prevent malware, ransomware, and identity-based attacks, achieve compliance across Windows, macOS, and Linux endpoints, and enable your zero trust strategy — without compromising on productivity.

Linux / Unix

17 topics

Windows & MacOS

131 topics

Entitle

Entitle takes the risk management burden off IT/DevOps teams and brings it back to Security, where it belongs. Our automated platform eliminates the tradeoff between productivity and security — the holy grail of access management.

General

19 topics

Identity Security Insights

Proactively strengthen identity security posture and build resilience against threats by uncovering identity vulnerabilities and hidden paths to privilege.

General

2 topics

BeyondInsight / Password Safe

Manage privileged passwords, accounts, keys, secrets, and sessions for people and machines and secure non-privileged employee passwords for business applications.

General

191 topics

Privileged Remote Access

Create identity-secure, just-in-time access to all your enterprise environments: cloud, on-premises, and OT.

General

102 topics

Remote Support

Supercharge your service desk with secure access and support for any device, any system, from anywhere – including Windows, macOS, Linux, Android, & iOS.

General

70 topics

Leaderboard

Show full leaderboard

Show full leaderboard

Earned Badges

Hakasehas earned the badge BCA: Endpoint Privilege Management - Windows
Hakasehas earned the badge BCA: Endpoint Privilege Management - Mac
Hakasehas earned the badge BCA: Remote Support
joselopezhas earned the badge BCA: Endpoint Privilege Management - Mac
gnajerahas earned the badge BCA: Password Safe

Show all badges

Upcoming Events

Privileged Access Management Buyer's Guide + Checklist

Download the full Buyer's Guide for Complete Privileged Access Management (PAM) to explore the evolution of privilege management and identity security, analyze current threat landscape trends, and assess key criteria for achieving your access security goals. Plus, get a customizable, interactive spreadsheet to evaluate PAM solutions and compare capabilities effectively.

Need more help?

Resources

Technical Documentation

Contact Support

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Login with the BeyondTrust Identity Service

Login to the community

Login with the BeyondTrust Identity Service

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK