Skip to main content

Recently active topics

92
A
abhijitdikshitNewcomer
 Windows & MacOS
How to block old version applications

I want to block applications running old version. How to block it based on min and max version as I tried adding it for chrome and did not work. I have chrome version 138.x.x.x I want to block if user is running less than mentioned version on machine. Can some one help? Below is my rule:Type : ExecutableApplication: Google ChromePublisher: Google LLCMax Version: 137.x.x.xI am still able to execute chrome with 138 version.

71
H
BeyondTrust Employee
M
Mohan UpadhayaApprentice
 General
Local Functional Account password rotate Error

we recently deployed BeyondTrust in our environment. so far it has been a learning process for me. I need help desperately about an issue i hope i can get help here. Thank you I have few dmz boxes in an address group and with local functional and scan accounts.  They all use the same functional account and password. on one of the six boxes I am getting error alert emailed with a message that the password rotate was failed Functional account..I have tried many suggested solutions including the article available here: https://beyondtrustcorp.service-now.com/csm?id=kb_article&sys_id=53adfd211b65e2106fe95287624bcb05. This error only occurs on server that is newly added to the group. The rest of the five servers are fine. This seemed to relate the Functional account on the machine. This VM was newly added to the existing group that already used a Functional account rotated password. I tested and i can login with both Functional and Scan accounts, they both are in local administrators. H

30
M
Prudhvi Keertipati
Prudhvi KeertipatiGuru
 General
Password Safe - SSH Proxy Session - Keep-Alive Connection

Is there way for the users to set the keep-alive count on the Putty client for those are launched from Password Safe SSH Proxy sessions?

133
Paulo144
I
immi563Rising Star
 General
dedicated account mapping for local accounts

Hi AllI am facing one issue in mapping dedicated account for ids on local dmz servers. admin id and users standard ids are not matching. in such case how should use the dedicated account mapping functionality?Below is data set-up 1. admin id on managed system is PAO123452. standard id of this user in user group is MSS12345Now since admin id is local i cannot use directory attribute.  in mapping Smart rule i think we cannot use map dedicated account to action with deciated account filter. Kindly help me how can i write the smart rule to map the deciated ids . I don't want to use one-to-one mapping as it will require to write lot of smart rule and lot of user group. Please help

838
I
H
HamzaTrailblazer
 General
RDP Linux using XRDP from PRA

we have linux server in which XRDP is installed. from console I cannot RDP the linux but I can do RDP from a server (jumpoint host).what am I doing wrong here? 

181
P
BeyondTrust Employee
Paulo144
Paulo144Veteran
 General
BI 25.1 - 405 method not allowed

Anyone else after updating to BI 25.1 is getting 405 when trying to edit/delete any item of Configuration? I Tried to edit a Api Registration and got 405, tried to delete a acess policy got 405, tried to enable Pre-Login banner, got the 405.I even applied the lastest hotfix for 25.1, but the problem continues, any other menu like managed sytem, assets the delete and put method works just fine. Just want to know if its a me problem or if anyone else saw the same before opening a case.Example:  

583
Paulo144
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
 General
Remote Support - Knowledge Article Publications (Jul 21 - Jul 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022081 - Approval emails for sessions have stopped working error - SMTP error [450] Service unavailable KB0022647 - How to download the SIEM Q radar plugin for Remote Support or Privileged Remote Access integration KB0022690 - Cannot connect to Representative Console. Error "Unable to establish a connection to the Secure Remote Access Appliance" KB0022705 - Does a live update require downtime?

50
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
 General
Privileged Remote Access - Knowledge Article Publications (Jul 21 - Jul 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022081 - Approval emails for sessions have stopped working error - SMTP error [450] Service unavailable KB0022647 - How to download the SIEM Q radar plugin for Remote Support or Privileged Remote Access integration KB0022705 - Does a live update require downtime?

10
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
 Linux / Unix
Endpoint Privilege Management (Unix/Linux) - Knowledge Article Publications (Jul 21 - Jul 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021379 - Does CVE-2024-6387 affect Endpoint Privilege Management? KB0022672 - pbevent.log is not updating

20
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
 Windows & MacOS
Endpoint Privilege Management (Windows/Mac) - Knowledge Article Publications (Jul 21 - Jul 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021379 - Does CVE-2024-6387 affect Endpoint Privilege Management? KB0021399 - Troubleshooting steps for forwarding Defendpoint events to event collector (GPO) KB0021460 - Endpoint Privilege Management GPO end of life (EOL) announcement and FAQ KB0022645 - EPM-WM update to Initialization Vector value for encrypting configuration values KB0022691 - What is the DriverInjectMethod registry value? KB0022693 - How to turn on local ECS events for EPM-W KB0022695 - Does full admin token prevent application control in screen sharing? KB0022700 - Analytics missing in EPM Cloud console KB0022724 - When 'Requires Elevation' is set in app definition EPM-W does not match, UAC is prompted

40
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
 General
BeyondInsight / Password Safe - Knowledge Article Publications (Jul 21 - Jul 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022503 - Workgroup does not change after editing it manually - Workgroup changes back to the original workgroup after updating KB0022659 - MongoDB error - MongoAuthenticationException: Unable to authenticate using sasl protocol mechanism SCRAM-SHA-1. MongoDB Authentication Failed. KB0022699 - Opening BI Configuration tool results in Error: C:\Program Files (x86)\BeyondTrust\BeyondInsight\WebSite\web.config file was not found KB0022709 - Some or all users receive the error "Page not found" when trying to login to PS cloud via SAML KB0022726 - Smart card authentication fails with error "Oops! Something went wrong! Automatic sign on failed"

30
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
 General
Active Directory (AD) Bridge - Knowledge Article Publications (Jul 21 - Jul 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022616 - Adtool add user to cell fails with ERROR: 400042: Failed to get object's GUID KB0022697 - Unable to login on some production hosts. Error "LW_ERROR_STRING_CONV_FAILED" KB0022708 - Some users are not showing when running enum-users KB0022719 - Why are large LDAP queries occurring on servers with AD Bridge? KB0022720 - Is there an AD Bridge Linux repo site? KB0022728 - Can AD Bridge be used to unlock Active Directory accounts remotely? KB0022729 - Can AD Bridge disconnect or logout of SSH?

00
GloriaB
BeyondTrust Employee
I
immi563Rising Star
 General
Bulk smartrules creation

Hi Everyone I have one requirement wherein Admin and Standard ids are not matching for local dmz servers. Hence i need to do one to one mapping. I have around 400 admin ids and hence i am required to create 400 smart rules.I have checked all the options and dedicated mapping is not possible since account is local and admin and Standard are not matching. I wanted to check is there any API available that i can use to create the Smart rules in bulk using Postman or powershell utility?Awaiting response. thanks in advance  Regards Imran Aliyani

333
I
H
HamzaTrailblazer
 General
PRA Virtual Machine sizing

we are planning to move from PRA B-200 physical to VM. the article below doesn’t explain that how many concurrent jump sessions (RDP/Shell/WEB) a VM can handle in Active-Passive configuration. ( considering not jump client installed)Virtual Appliance installation  

40
H
H
HigorTrailblazer
 General
Change location of PuTTY for Password Safe Cloud

Hi, is there a way to change PuTTY from C:\Program Files\PuTTY\putty.exe to C:\PuTTY\putty.exe as my Default Launch path? 

172
H
R
rgkesselRising Star
 General
PSafe seems to not execute the pwdadm -c/-f NOCHECK command on AIX Servers

Hello everyone,We're experiencing a situation in our environment where PSafe appears to be failing to execute or executing pwdadm commands incorrectly on AIX servers.At the beginning of the operation, we noticed that all credentials for which PSafe rotated the password were prompted by the user for a new password change.This is due to AIX adding the ADMCHG flag to the credential after the password is rotated.To avoid this, the original password rotation workflow included the command pwdadm -f NOCHECK <<ManAcctName>>.Even with this command in the workflow, the credential remained with ADMCHG and the NOCHECK flag was not added.So, we changed the command to pwdadm -c <<ManAcctName>> and added two more consecutive executions.After this change, the password rotations no longer prompted the user to change the password at the next login, and the ADMCHG flag was removed.However, an AIX server in our environment doesn't log the execution of pwdadm -c even after three con

803
R
S
ssethurajanApprentice
 General
X window forwarding using the X11

Vendor user is facing issues while trying to launch a shell jump session (via Jumpoint) from Mac endpoint. User is typing the below command to invoke the web console on the shell jump session but getting display error. Target Endpoint: Rocky Linux 8.9, 64-bitsystemctl enable --now cockpit.socket~]$ DataEditorError: DataEditor: Can't Open Display They also want to know if PRA shell jump supports X window forwarding using the X11 protocol. Any suggestions to resolve this problem?

1232
R
S
Sathiya.KNewcomer
 General
Request for AAA Server Onboarding Requirements for BeyondTrust PAM

Hi,I would like to understand the process for onboarding an AAA server into BeyondTrust PAM. Could you please confirm whether this is supported, and if so, share the necessary steps or prerequisites for onboarding? Regards, M.Sathiya

101
J
BeyondTrust Employee
leonoehlinger
leonoehlingerApprentice
 General
Jump Clients not reconnecting

We often hear from our techs that Jump Clients stay offline even though the PC is only and reachable.Trying to restart the sra-pin Service or the whole PC does nothing.The only way you get this client back online is with the user clicking onto “Reconnect now”.As soon as you click reconnect now the client comes back online.Does anyone else have this problem or has an idea how we can get around this?Another problem is that after a reboot the Jump Client often takes more than 10 minutes to get back online. 

264
leonoehlinger
J
Jens HansenVeteran
 Windows & MacOS
Are Power Rules now obsolete?

Did the Power Rule for Privilege Management for Windows become obsolete with the introduction of the Application Rule filter option?Absolutely not. Power Rules are indeed more powerful that what is documented and brings many more options, to cover a “lack” of functions or new innovation.I frequently encounter scenarios where customers struggle to capture batch files, registry files, or other unusual launches that show up in our analytics from client machines they can’t access.To address this, I developed a PowerShell script to be used as a Power Rule. My objective was to collect these uncommon `.bat`, `.cmd`, `.ps1`, `.reg`, and `.vbs` files which may pose unknown threats or conflict with software restriction policies etc.In the script, I defined the target file extensions and used:Get-PRVariable -Name "PG_PROG_PATH"to retrieve the file and path. If the file matched one of the specified extensions and was under 200KB, the script would initiate its workload.The workload involved connect

371
P
BeyondTrust Employee
J
JackApprentice
 Windows & MacOS
EPM install issue in Autopilot build since July 2025 Windows patches

Hi all, has anyone seen the following issue we have been experiencing?Autopilot pre-provisioning has problems in the final stages if the EPM agent is installed during the Hybrid build and the OS level is Windows 11 23H2 July 2025.The Avecto driver (PGDriver.sys) seems to be clashing with the Autopilot final OOBE stage preventing the device from finishing on the correct Windows logon screen

1114
J
J
JackApprentice
 Windows & MacOS
EPM Feature Requests

Hi Beyond Trust community,I have a couple of Beyond Trust - Endpoint Privilege Management suggestions that I would like to share please: We recently found many devices had become disconnected from the EPM Console due to them being deleted. This was likely due to inactivity, where many machines were built in advance of a laptop migration and kept in storage. From the machines, it was not obvious there was a problem until some devices started to show symptoms that were fixed in an earlier policy revision. When the machine is checked, it still had an old policy revision listed. This means even our latest block rules were not working on these devices. To mitigate this issue, we would find the following agent features extremely useful:Feature Request: Ability to check policy name and revision in the Windows Registry / file or WMI etc.Reason: We can keep an active deployment that checks for the revision and if it falls behind we can have an automatic remediation.How we are currently evaluati

533
J
M
MatsuNewcomer
 General
Network Tunnel drops connectivity on Jumpoint temporary fix, KB0021363 related

We recently encountered a recurring issue impacting the accessibility of Jumpoints, which we have traced back to behaviors described in KB0021363. The root of the problem appears to be interference between the old and new network management features, particularly when IP assignments are modified either through binding on virtual machines' NICs or via IP changes on bare metal systems.ObservationsWhen these changes occur, the resulting network configuration across the multiple management interfaces becomes inconsistent. This inconsistency causes the Jumpoint to: Attempt to resolve to its own address, Become entirely unresolvable, or Exhibit packet fragmentation or corruption during analysis. Network inspection tools and bomgar logs show erratic behavior. Logs typically reveal incomplete packets or generalized packet errors, but offer no definitive indicators as to the root cause. The symptoms include: Dropped connections, Fluctuating tunnel availability, Inconsistent routing beha

1342
C
T
tmontagueRising Star
 General
Automatically linking multiple managed accounts to managed systems based on services

I’m trying to figure out if this is even possible.  I feel like it is, but I’m probably missing how to accomplish it.So we have 60 something Windows servers running SQL server.  We have 20 something AD accounts that run SQL on these various servers.  Ideally what I’d like to do is build a rule that adds the appropriate linked managed system to each managed account that is running the SQL services on those systems. So the end result would be I could go into each account, and see the system or systems that it is running SQL on.I’d really like this to work automatically so that any time a new server is added, or an account is added to another system, it automatically gets added to the list of linked systems for that account.    I can easily create rules to get a list of all of these servers running sql.  I can also easily create a rule that shows me all of these accounts (they all start with the same thing).  But is there a way to then just link each account to the appropriate server with

7410
rhagerm
P
pvermaNewcomer
 General
Inspect /dev tools on a Web Jump on PRA

Does anyone know if we can leverage inspect /dev tools on a Web Jump on PRA? We have developers trying to inspect and open dev tools on the web page but looks like it doesn’t work?

552
R

Badge Earners

  • BCIE: Privileged Remote Access
    Flohas earned the badge BCIE: Privileged Remote Access
  • BCIE: Privileged Remote Access
    Ro-Manhas earned the badge BCIE: Privileged Remote Access
  • BCSE: Privileged Remote Access
    Ro-Manhas earned the badge BCSE: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Linux
    Mudupurihas earned the badge BCA: Endpoint Privilege Management - Linux
  • BCIE: Privileged Remote Access
    vilasboashas earned the badge BCIE: Privileged Remote Access
Show all badges
Terms & ConditionsCookie settings