Recently active topics

Hi All,We’re relatively new to BeyondTrust PRA and are deploying multiple on‑prem PRA systems (one large Atlas system plus several HA systems for data‑residency). As we plan appliance upgrades (e.g. 24.2.3 → 24.3.3), we have concerns around remote access disruption and network impact, particularly related to Jumpoints. Environment24x7 OT environments 100+ Jumpoints (growing significantly) Jumpoints used as Jump Zone proxies aligned to Purdue/network segmentation JumpItems - primarily JumpClients and RDP. Remote sites connect via low‑bandwidth, often congested satellite linksKey ConcernsJumpoints are not backward compatible Remote access is unavailable until Jumpoints are upgraded to match the appliance version. Upgrade size & network impact ​​​​​​​Latest guidance suggests Jumpoint upgrades are full installers (~130 MB), creating risk of network congestion at scale. Lack of upgrade controls for Jumpoints ​​​​​​​No way to defer/disable auto‑updates, limit concurrency, throttle ban

Hello team,I am currently testing the Jump Client for macOS in the PRA cloud. When initiating a jump, the session connects immediately without prompting for credentials.Could you please advise whether it is possible to configure credential injection before the jump is established? Thank you.

Hi BeyondTrust Community,I recently deploy the BeyondTrust PasswordSafe (On-Prem) for 2 nodes, 1 for Management (Single Appliance Deployment solution)  and 1 for Worker (SQL less solution no HA) with a single-standalone remote database. After fully deploy those UVM, I try to test the credential on both Management Account, and Functional account but resulted in the mentioned error. Will there be any solution for this issue? I try to looking for the KB within the BeyondTrust customer portal and found nothing.I do appreciate for any solution I will try what suggested. Thank you,

Hello All,We have a requirement for to not onboard Oracle user account while performing oracle DB scan. We only want ‘Oracle system accounts’ and ‘Oracle Service accounts’ to be onboarded. We have attributes (Same as in DB) defined in BeyondInsight configuration. When we attempt to onboard DB accounts using the smart rule, it captures all accounts. Consequently, when we use the 'Set attributes in each account' action within the smart rule, it assigns attributes to all accounts, regardless of the account type. Thanks,Prasad

Hello everyone!We are facing a possible configuration issue, we believe.Is there any setting for using BeyondTrust Workforce Passwords in a fixed browser window? The problem is that every time we authenticate, a new browser window opens, causing us to lose visibility and usability. Has anyone else encountered this situation?Thank you very much.  

We are trying to use API query for creating session request using dedicated API account. using API , we are pushing the request to PAM including asset ID and admin account ID and duration ...etc.when we login on the PS user interface using API account, we can find the requests pushed using API.when we login on PS UI using the user login account, the session request isn't listed/viewed in his list. We tried to use Runas option in the authorization but there is no changes. session request is only viewed under the API account UI.  Please advise what could be the option to create the request for the admins using dedicated API account.

Hi AllI am trying to find a way to use the API to force check in of vault accounts which have had their password checked out for over 7 days,I think it is crazy to allow the PRA and the vault account members to checkout their password and allow it to stay checked out (this could be over a year) therefore they could use the password and put it into some automated tasks where it is in plain text and as it is never checked in this will always stay the same.It seems a lot safer if there was an option within PRA to force check in ( a tick box or something ) and a correct schedule that could be set that would check in all passwords on a set day and time and rotate them. Instead I am having to mess about with APIs which are not very well documented in my opinion.Therefore has anyone needed to do this and if so how did they go about it?Thank you in advance.

The following articles were published last week. New Knowledge Base Articles: KB0021991 - Email alert "No Data Syncs Are Being Pulled" KB0022022 - Password reset emails are not sending receive error: Reset password email not sent. The SMTP server responded with: connection timed out. KB0022034 - Error - "Invalid Session Key" when starting session through issue submission or session key KB0023223 - How to install a Linux Jumpoint (headless) KB0023234 - Error when attempting to set network restrictions "You are not allowed to save settings that will restrict your current IP address" KB0023236 - Emails from SRA cloud appliance fail "SMTP error [450]. Details: 4.7.25 Service unavailable" KB0023238 - How to uninstall a Jumpoint from a Linux system KB0023240 - Wrong URL displayed on the Remote Support - Start Support Session screen

The following articles were published last week. New Knowledge Base Articles: KB0021991 - Email alert "No Data Syncs Are Being Pulled" KB0022022 - Password reset emails are not sending receive error: Reset password email not sent. The SMTP server responded with: connection timed out. KB0023223 - How to install a Linux Jumpoint (headless) KB0023234 - Error when attempting to set network restrictions "You are not allowed to save settings that will restrict your current IP address" KB0023236 - Emails from SRA cloud appliance fail "SMTP error [450]. Details: 4.7.25 Service unavailable" KB0023238 - How to uninstall a Jumpoint from a Linux system

The following articles were published last week. New Knowledge Base Articles: KB0023237 - EPM-UL shell or bash command error: 3430 Insecure operation. 3201.08 Exec of /bin/bash failed: Operation not permitted

The following articles were published last week. New Knowledge Base Articles: KB0023244 - UseAlternateTokenLaunch - What it is and how to use it KB0023245 - Validate setting fails "Unable to Connect to the Microsoft Entra ID with the provided credentials" KB0023249 - Endpoint machines domain change not showing in EPM Cloud

The following articles were published last week. New Knowledge Base Articles: KB0021271 - Unable to view managed account in the Web Console KB0021536 - How to use the HSM Decommissioning Utility KB0022029 - RDP sessions are disconnecting after a few minutes "The connection to the remote computer was lost, possibly due to network connectivity problems" KB0022391 - Cannot delete access policy error "Unable to delete access policy as it has dependencies" KB0023212 - Unable to connect SSH session from macOS workstation to Linux managed system KB0023235 - Unable to create secret for domain group after upgrading to 24.3 or higher

The following articles were published last week. New Knowledge Base Articles: KB0023239 - Where to find response procedures for AD Bridge failure states KB0023241 - Information on tenantjoin renewing secrets in AD Bridge 25.2 and higher

I’m starting to onboard users and computers to password safe and I want to allocate certain users to certain servers.So to illustrate.Team A has 5 users each user has a std AD account and a dedicated admin AD account.This team is responsible for several servers which I have put in an AD group. I can do the directory queries and onboard the servers and manage them. I can also onboard and manage the dedicated admin accounts and link them to the std accounts.I’ve hit a road block linking the accounts to the servers.There is an existing onboarding rule which sets an attribute (Tier1Server) on Servers and a rule which sets an attribute (Tier1account) on T1 accounts. The servers I want to sort now and the team users are a subset of Tier 1 so I should be able to use the similar process using attributes.So I create a managed account smart rule with selection criteria of the directory query relating to that user group so I can set an attribute of the team name on those users. But when I save an

Hello all, We are experiencing a behavior with RDP sessions via Password Safe initiated from machines with Windows 11.The session has a slow image loading, appearing to load in rows of images and in blocks.A simple movement of windows within the RDP session causes the image loading of this movement to be very slow.This does not occur if the RDP session is direct with the destination server.But if the connection is through Password Safe being Windows 11 > Resource Broker > Destination server, this slowness is noticed. Has anyone else noticed this problem in your environments? Additionally, this behavior does not occur in Windows 10.Points that I have already checked:- The software installed on the computers are the same between Windows 10 and 11;- The network settings are the same. This behavior occurs on both wireless and wired networks;- The GPOs of the Windows 10/11 stations, Resource Brokers and destination servers have already been checked. No Remote Desktop configurations th

Can BeyondTrust Password Safe support strict logical segregation between two departments (Network Division and IT Security Division) within the same Password Safe deployment, ensuring no visibility of assets, accounts, users, or sessions across divisions? Component Network Division IT Security Division PAM Admin Network PAM Admin Security PAM Admin Assets Network devices Security infrastructure Accounts Network privileged accounts Security privileged accounts Users Network engineers Security engineers Policies Network-specific Security-specific Reports Network only Security only Configuration Network Only Security Only

PRA requires a user to login a first time in order to be available in PRA for example to assign vault accounts.Unfortunately this is causing problems with new employees which are onboarded into PRA.Unless they have never logged in, administrators cannot assign personal vault accounts. If the user logs in, and does not see his/her vault account, they create tickets. This is a very large customer and it is difficult to orchestrate / communicate such a process and they would like to automatically provision new users (from AD). How do other customers provision users up-front and define vault accounts, etc. and not depend on a user’s first login?  

Hello Everyone, Is it possible to use the file transfer option via Remote VNC?

Hi All,I have got the PWS to PRA connection working, I can see my managed test account in PRA but when I try and use the cred store to connect, I get the following error. (Could not find a schedule to use with this release request)I have followed the guide (BeyondInsight / Password Safe - Unable to pull Password Safe Credential via ECM. Error: "Could not find a schedule to use with release request".)Any ideas where I can start to look? log? or have I missed something simple?

The following articles were published last week. New Knowledge Base Articles: KB0021950 - Can users rename a Jump Item in Remote Support or Privileged Remote Access? KB0021988 - Missing "Forgot Password?" link on login page KB0022789 - MSI installer configured in SCCM no longer works after upgrade KB0023163 - Elevated access not working in command shell

The following articles were published last week. New Knowledge Base Articles: KB0021950 - Can users rename a Jump Item in Remote Support or Privileged Remote Access? KB0021988 - Missing "Forgot Password?" link on login page KB0023163 - Elevated access not working in command shell

The following articles were published last week. New Knowledge Base Articles: KB0023225 - Does CVE-2025-9230 and CVE-2025-9232 affect EPM-UL?

The following articles were published last week. New Knowledge Base Articles: KB0021348 - EPM rule not matching after using an event (Add to Policy) to create the definition KB0022462 - EndpointUtility freezes when run from elevated cmd or PowerShell

The following articles were published last week. New Knowledge Base Articles: KB0023213 - Mongo DB connection string does not show when performing an Access Request

The following articles were published last week. New Knowledge Base Articles: KB0021985 - TOTP setting "Enable for new directory accounts" or "Enable for new local accounts" disabled unexpectedly KB0021993 - How to sync Microsoft Entra ID groups on a schedule - How to turn off group sync schedule per group KB0021996 - Discovery scanner not working - "Event 3: WebHost failed to process a request" error in Windows Application logs KB0022049 - PS Cloud web console shows the same IP address for multiple Resource Brokers KB0022515 - Workforce Passwords sync fails with message 'an error occurred' KB0022563 - Active Directory users created via SAML are missing attributes KB0022726 - Smart card authentication fails with error "Oops! Something went wrong! Automatic sign on failed" KB0023159 - Secrets Safe API endpoint GET /Secrets-Safe/Secrets returns password as null