Active Directory (AD) Bridge

Kerberos Caches How to clear Kerberos Credentials CachesAD Bridge (ADB) does not support clearing Kerberos cache files (typically stored in /tmp as krb5cc_xxxxx). However, since these files reside in /tmp, they are automatically removed upon system restart. Additionally, they can be manually deleted without impacting the functionality of ADB, provided that Kerberos and AD Bridge are functioning correctly. The cache will regenerate automatically when needed.  /opt/pbis/bin/kdestroy Adding the following to /etc/bash.bash_logout will remove the current user's cache file at logoff. The below command to delete the current user's cache file, or with -c username to delete another user's (with root permission): /opt/pbis/bin/kdestroy Refer to Kerberos commands in ADB for more information.  Customer Case Studyivision: How ivision Simplifies and Scales Identity Security with BeyondTrust Latest Available VersionsAD Bridge 26.1 - May 2026AD Bridge 25.2 – December 2025 BeeKeepers CommunityClick her

AD Bridge 26.1.0 Machine Account Password EncryptionTo improve credential protection, as of ADBridge 26.1, machine account passwords are encrypted by default when stored in the machine-level secrets stored (registry) on Linux systems.  This reduces exposure in the event of system compromise and better aligns with common security control requirements for authenticator protection.  The registry setting on the Linux system added by Active Directory Bridge controls the machine account password encryption behavior:HKEY_THIS_MACHINE\Services\lsass\Parameters\Providers\ActiveDirectory\PstoreCompatLevelPstoreCompatLevel settings: 1 - The machine account password is encrypted when stored 0 - The machine account password is not encrypted when stored When upgrading from a previous AD Bridge release to 26.1, the plaintext machine password will be encrypted the next time it rotates. Existing binaries that use the machine password are unaffected and will continue to work. To disable the setting, r

New Features in AD Bridge 25.2 Improved Linux workstation experience with Entra ID We’ve enhanced the Linux workstation login experience by integrating Microsoft Entra ID, making identity management simpler and more secure. This improvement supports the growing adoption of Entra ID bridging on Linux desktops, enabling organizations to unify access across platforms and strengthen compliance Tenantjoin: Endpoint key renewal A new configuration option allows administrators to define the lifespan of an app secret, enabling automated renewal workflows. When the secret approaches expiration, a renewal process is triggered by a script, which can be customized by administrators to align with their preferred tooling or operational practices. More information can be found in the new config option MachineSecretLifespan. Customer Case Study Nash County Public Schools: Nash County Public Schools Transforms IT Support with BeyondTrust Remote Support Latest Available Version AD Bridge 25.2 – December

AD Bridge Supported Versions Lifecycle Information BeyondTrust provides support for any major versions of our products for two (2) years from the generally available (GA) release date. We recommend reviewing the product lifecycle at least once a year and not being more than two versions behind as it may make it more complex to upgrade. For details on the supported platforms for each version, refer to KB0019169.MR - Maintenance Release, these have the same end of support as the GA release  AD Bridge Version Release Date End of Support Release Notes 25.1 09 Oct 2025 08 Oct 2027 Details 24.2.3 (MR) 17 Jul 2025 21 Nov 2026 Details 24.2.2 (MR) 01 Apr 2025 21 Nov 2026 Details 24.2.1 (MR) 03 Dec 2024 21 Nov 2026 Details 24.2 21 Nov 2024 21 Nov 2026 Details 24.1.2 (MR) 20 Jun 2024 28 Feb 2026

Creating a Computer Account Object in Active Directory using adtool Command Computer account objects can be created in Active Directory, without switching over to a Windows management host, ahead of joining the computer to the domain.  On the Unix or Linux client use the /opt/pbis/bin/adtool, with the new-computer action. This is useful for administrators who want to create named computer objects as one user, but run domain join operations as a different user with different privileges. Command /opt/pbis/bin/adtool -a new-computer <ARGUMENTS> Acceptable arguments ([X] - required): --dn=STRING                                    DN/RDN of the parent container/OU containing the computer. (use '-' for stdin input)--name=STRING                               Name of the new computer. (use '-' for stdin input) [X]--pre-win-2000-name=STRING     Pre Windows-2000 name.--description=STRING                    Description of the computer--dnshostname=STRING                Fully Qualified DNS n