Skip to main content

Recently active topics

78
S
SFATrailblazer
 General
how to run powershellscript to change password

Hi I have application API to change password , how can I use it to trigger password change via PAM. For using application host, I am unable to use WINDOWS system . I found this link here-Resource Kit SDK Plugin for PowerShell Scripts -Should I go with above? or propagation action? If using propagation action, what needs to be the platform? I mainly want to do trigger generation of password based of password policy, update it just in the BT DB and not try to apply in system account. I have a windows system with the script and want to trigger change of password from BT .  

80
S
A
AyanWSTrailblazer
 General
Extended RDP session - 2-4 days

Team,I am curious to know whether it’s possible to extend/allow RDP session for more than 2 days. Concern team wants to perform a job and they might need to keep the session active for about 2 days at least. Is it something we can leverage from BI console? Please suggest.

492
A
P
prasadp87Trailblazer
 General
How to add scanned account as Managed account

Hello All,I have quick question about Beyond trust discovery scan accounts. We have configured scanning for certain servers accounts. When I look into scanned asset, I am able to convert “unmanaged” account from General data section but I dont see option to convert “Users” shown in Scan data section. Does anyone know how we can get these users in Managed account list.   

111
H
BeyondTrust Employee
T
Tina_KTrailblazer
 General
Session gets lost if remote computer is offline too long

Hello again,sometimes a support session gets lost or “broken” if the remote computer is offline for too long. (For example because it is making a BIOS Update that takes very long… or the user does not return to reboot for a while) The supporter can only End the session in this case and has to make a new one if the customer returns. Screen sharing controls turn grey and only “close” is available.Is there a way to set the timeout for “customer left session” higher so the session does not get lost?I did not find anything in the admin console or the knowledge base...

202
T
A
Anil ReddyApprentice
 General
virtual appliance deployment on vm for passwordsafe on prem

HI All, Planning to configure on prem virtual appliance on VM new server to deploy the BI and passwordsafe.Can you share any one the article to start the deployment step onwords ,how we can go head to complete this new setup for testing purpose we are planning to deploy only one appliance. Thanks 

214
Prudhvi Keertipati
P
prasadp87Trailblazer
 General
Can NTLM be disabled for Beyond Trust.

Hello Team,  We have received a requirement from our security team to disable NTLM for Beyond Trust. We are using Beyond Insight Password safe and U series appliance.I have seen few of the topic which discuss about same but not sure if we still can disable NTLM and it won't break anything.  Some of the reference topics are -Endpoint Privilege Management - Can EPM policy be configured to deactivate NTLM ?BeyondInsight / Password Safe - NTLM is being deprecated; can it be removed from U-Series appliances? Please suggest. Thanks,Prasad 

435
P
C
Carlos MendonçaTrailblazer
 General
Password Safe - Managed Account

Hello,Please, how do I synchronize user accounts in the domain to managed accounts? To have visibility of all user accounts and rotate the password if necessary.  

273
Prudhvi Keertipati
P
pphung301Apprentice
 Windows & MacOS
unnapproved Updates to Microsoft Teams

Hi, I am getting a prompt of an unapproved app and after looking into it in Analytics, it seems to be from Microsoft Teams updates which does not carry a Publisher so its unsigned.  Whats the best way to allow this since there is no signed info for this?   ApplicationApp DescriptionPublisherOn DemandNoApplication TypeInstaller PackageFile PathExecutable Pathc:\program files\windowsapps\msteams_25153.1010.3727.5483_x64__8wekyb3d8bbwe\ms-teamsupdate.exeCommand Line"C:\Program Files\WindowsApps\MSTeams_25153.1010.3727.5483_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 9e3e64d2-2229-4fc7-90dd-70234b468a6b -Trigger EnsureTmaAtStartupApp NameApp VersionFile VersionHash SHA1Hash SHA256Hash MD5File Owner NameProduct CodeUpgrade Code{97F40CEA-BEDE-40ED-A9A3-9354C8E64392}Download URLBeyondTrust ZoneDrive TypeElevation MethodAdmin accountPolicyApplication DescriptionAny MSI Installer PackageApplication Group Name(Default) Any Signed UAC PromptMatched as Child Proce

544
P
B
bpkothariApprentice
 Secrets and Non Human Identities
Password Aging in Password Safe Secret Safe

We are facing a common challenge in password vaulting systems where the password age isn't directly tracked, and the password hash changes even when unrelated attributes are modified. This makes it difficult to determine when the password was last changed.Problem SummaryNo dedicated timestamp for password change. Password hash changes even when non-password attributes are modified. You need to detect passwords older than 2 years to raise a security finding. How to solve this in secret safe?

183
B
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 General
Monthly Buzz - June - Privileged Remote Access

What’s New in BeyondTrust Privileged Remote Access 25.1: Enhanced Security & Stability for Privileged Access Everywhere BeyondTrust continues to raise the standard for privileged access security. Version 25.1 of BeyondTrust Privileged Remote Access (PRA) delivers critical behind-the-scenes upgrades, doubling down on BeyondTrust’s mission to deliver the most dependable, secure privileged remote access platform on the market. This maintenance release focuses on providing stronger security, improved reliability, and more seamless control of privileged sessions. Version 25.1 rolls up recent security patches, runs them through an exhaustive regression test suite, and layers in targeted stability improvements and key performance refinements for both cloud and on-prem environments. This update is available whether you run a cloud or on-prem deployment of Privileged Remote Access. Cloud users receive updates automatically. On-prem customers can download and apply version 25.1 from the appl

60
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 General
Monthly Buzz - June - Remote Support

BeyondTrust Remote Support 25.1: Hardened for Trust, Tuned for Performance In Remote Support 25.1, BeyondTrust is reinforcing its core commitment to security, stability, reliability, and customer confidence. This release focuses on strengthening our foundation—delivering a smoother experience with enhanced stability and robust security updates. Our top priority is to provide customers with the most secure and dependable remote access solution possible. To ensure maximum reliability, we prioritized a comprehensive security patch rollup, focused quality assurance (QA) efforts that include a full regression testing cycle, and key stability enhancements. Our goal: to empower your support teams to work with confidence, knowing they’re backed by the most secure and dependable remote access solution. These new features are designed to provide a smoother, more resilient experience, helping you operate with confidence and peace of mind. We strongly recommend this update for all customers. Cloud

120
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 Linux / Unix
Monthly Buzz - June - Privilege Management Unix Linux

EPM Unix & Linux (UL) Supported Versions Lifecycle and OS Compatibility Information The tables below detail the operating systems that are fully supported and actively maintained for Endpoint Privilege Management for Unix and Linux (EPM-UL). These EPM-UL versions will be updated if necessary to fix problems with functionality and enhancements. In line with the other BeyondTrust products, EPM-UL releases are supported for 2 years from the initial Certified date. File names are structured as <Release Identifier>.tar.Z where the <Release Identifier> is pmul_<OS Version>-<Release Number>. Important: Before any clients are upgraded to the latest release, it's recommended that the license, policy, and log servers are upgraded to the latest release. EPM-L (SaaS) - Non-cached clients  EPM-UL Version Certified Date End of Support 25.1.4 May 2025 Apr 2027 25.1.3 Apr 2025 Apr 2027 25.1.2 Mar

30
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 General
Monthly Buzz - June - Entitle

Setting up a Virtual Application in Entitle A virtual application is a mechanism which streamlines the end-user experience in scenarios where access requests to an application are implemented indirectly in the background. For example, by joining an IdP group which triggers IdP provisioning flow. Instead of navigating technical steps, the end user simply selects the application from a list and submits an access request, without needing to understand the underlying process. This feature is designed to simplify the end-user experience by renaming resources, such as Okta groups, to something more intuitive for different environment scenarios. The user will see a recognizable name and icon in the search results which they can request access to, without being aware of the complex implementation. Learn more and watch the demo video here Latest Available Version: Entitle May 2025 Upcoming and In Case You Missed It Webinars Road Map :Upcoming Entitle Road Map Thursday, July 17th 2025June 16th 2

130
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 Windows & MacOS
Monthly Buzz - June - Endpoint Privilege Management

Maximizing Endpoint Security with IBM QRadar and BeyondTrust Endpoint Privilege Management The integration between BeyondTrust Endpoint Privilege Management (EPM) and IBM QRadar enhances security by providing seamless visibility into privileged activity and endpoint events within a centralized security operations dashboard.Key features of the integration include:Real-time event correlation and alerting: EPM events forward to QRadar, where they correlate with other security data for more effective threat detection. Comprehensive visibility into application usage: EPM provides detailed insights into application behavior and privilege elevation requests across endpoints, enabling better policy enforcement and anomaly detection. Improved incident response: Privilege-related events alongside other security data are available for analysis within QRadar, allowing security teams to quickly prioritize and respond to incidents. Strengthened least privilege enforcement: By combining QRadar’s dete

40
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 General
Monthly Buzz - June - Insights

How to connect Identity Security Insights to BeyondTrust Password Safe Cloud Identity Security Insights (Insights) connectors allow the integration of first- and third-party identity and account information with the BeyondTrust Insights console. Leveraging this data, the Insights platform constructs robust identity analytics, proficiently identifies potential identity security vulnerabilities, and offers informed security guidance.Upon successful configuration, Insights automatically schedules and pulls data from the enabled connectors. This allows it to update the content of the console's dashboards and reports with fresh insights, revised recommendations, and recent threat detectionsFor Password Safe 24.1.1 and newer releases, when an Identity Security Insights connector installation key is enabled in Password Safe, discovery scan events are forwarded from the event service to Identity Security Insights. This provides visibility into possible attack paths, identity-based threats, and

10
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 General
Monthly Buzz - June - Password Safe

Discover What's New in Password Safe 25.1 Workforce Passwords for PathfinderWith Password Safe 25.1, Workforce Passwords is fully compatible with Pathfinder! Previously, the extension didn’t work when customers were activated in Pathfinder. Now, everything runs as expected. Plus, there’s a great new feature on the login screen: a handy dropdown menu that lets you choose your login portal. Simply select Pathfinder to sign in via beyondtrust.io, then enter your Pathfinder credentials to access your Workforce Passwords secrets with ease. Mobile Application Session Timeout SettingIn Password Safe Cloud and on-prem, you’re in control - configure the Mobile app to auto-timeout after a set number of minutes! Deployable WFP ExtensionWorkforce Passwords makes it easy and secure to store and access business credentials right from your browser. And now with Password Safe 25.1, deploying the WFP browser extension is smoother than ever! Admins can effortlessly roll out the extension across Chrome,

120
B
Community Manager
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
 General
Monthly Buzz - June - Active Directory Bridge

How to Check the Health of AD Bridge AgentAfter an upgrade, it's important to perform key checks to verify that everything is functioning as expected. Check if the Active Directory is onlineRun the following command with root privileges: /opt/pbis/get-status Example successful output: [Authentication provider: lsa-activedirectory-provider] Status: Online Mode: Un-provisioned Domain: example.com Forest: example.com Site: Default-First-Site-Name  If the result is unknown, then from the console, you will need to leave the domain, go to Active Directory, and delete the computer object. Wait approximately 15 minutes, or however long it takes for replication to complete, then join. For more information, refer to Unable to login - pbis status returns unknown. Enumerate UsersThe AD Bridge agent enumerates users in the primary domain.  You can enumerate the users in Active Directory by running the following command: /opt/pbis/bin/enum-users Wait at least 15 minutes after running the command.  I

20
B
Community Manager
R
Raja SekharApprentice
 General
where to find scheduled password change logs

Hi Team,  Please help me to find out the logs of the scheduled password change on UVM. Best Regards,Raja Sekhar L.

2753
B
N
NectarNinjaApprentice
 General
RDP Failed Tested pretty much everything...

Hi everyone, hope you are doing well.Recently, we’ve been doing some testing and scratching our heads since its impossible to succeed.We’re attempting to connect to an Asset using Passwod Safe RDP session, but the PBSM log message shows as follows:#######################################################################2025/06/27 11:47:45.577 531988 523196 INFO: RDP Handler 531988 starting2025/06/27 11:47:45.592 531988 523196 WARNING: Could not open HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443 0x22025/06/27 11:47:45.592 531988 523196 INFO: Reading self signed cert2025/06/27 11:47:45.795 531988 534272 INFO: (RDP server) Client Security: NLA:1 TLS:1 RDP:02025/06/27 11:47:45.795 531988 534272 INFO: (RDP server) Server Security: NLA:0 TLS:1 RDP:02025/06/27 11:47:45.795 531988 534272 INFO: (RDP server) Negotiated Security: NLA:0 TLS:1 RDP:02025/06/27 11:47:45.858 531988 534272 INFO: (RDP server) Accepted client: CVLP-JPALACIN2025/06/27 11:47:45.858 531988

334
Paulo144
P
prakash.rApprentice
 General
Caching Issue with Web Applications via Password Safe and Microsoft Remote Desktop on MacOS

Hi,{This issue is only applicable to MacOS environments}Is anyone facing an issue where, when launching a web application (using PSautomate) via Password Safe in MacOS using the Microsoft Remote Desktop application, there is some sort of caching issue? For example, let’s say I download the RDP file for a web application at "https://app1.example.com"; the Microsoft Remote Desktop will prompt an “RDP certificate warning,” and the user will click "Continue," allowing the browser and web application to launch successfully. Example of “RDP Certificate Warning” However, once they close this web application browser (browser only and not the entire Microsoft remote desktop app) and launch another web application session (such as "https://app2.example.com") using a new RDP file downloaded from the Password Safe portal, it doesn’t prompt the “RDP certificate warning” and instead launches the old web application ("https://app1.example.com") session instead of the new one, even though we clearly l

160
P
nemer.scafutto
nemer.scafuttoApprentice
 General
Concurrent Web Jump Limit

Hello,I have a customer who is having a question about the Vendors section of the PRA.In the customer's environment, there is only one group of Vendors, and they are complaining that they can only perform Web Jumps in 3 sessions simultaneously. Is this the limit or is there a way that can be configured so that they can perform more jumps?

342
Paulo144
M
mjhallVeteran
 General
Renewing Remote Support Certificates - Best Practice

Hello,We are coming up to our certificate renewal, and I noticed that the BeyondTrust documentation states “You do not need to create a new certificate request”, and to provide the original CSR if the CA doesn’t already have it.  See DigiCert documentation, “Best practice is to generate a new CSR when renewing your SSL/TLS certificate. This creates a new, unique keypair (public/private) for the renewed certificate.”  Why would BeyondTrust, a company developing security products, recommend a less secure process? Am I misunderstanding something, or should the BeyondTrust documentation follow industry best practices for renewing certificates which is to generate a new CSR in order to create a new keypair? 

221
L
H
HamzaTrailblazer
 General
PRA Base 7.4.0 Supports PRA Site 24.x.x

can we only upgrade PRA base to 7.4 while on 24.x.x or it’s must to upgrade PRA site to 25.x.x after upgrading Base to 7.4 ?

191
P
BeyondTrust Employee
R
RidwaanKApprentice
 General
Registered API usage reporting

I would like to enquire about api’s that we have registered on password safe how do we report on the activity. Example of what we require .If we create a API for a service account for example that is used by postman how do we report on the usage of the api . The reason is is the api that is registered is not is use we want to clean up .

153
H
BeyondTrust Employee
A
AndyHTrailblazer
 General
How to add a discovery scanner?p

Hello, we have 2 U-series Appliances for HA. On the “Asset” section, Appliance1 was shown as “discovery scanner”. However, Appliance2 is not “Discovery Scanner”. When we swap the active appliance to Appliance2, all discovery jobs are failed. How could we add the Appliance2 to “Discovery Scanner”? Thanks,

212
A

Badge Earners

  • BCIE: Password Safe
    LuanCarneirohas earned the badge BCIE: Password Safe
  • BCA: Password Safe
    Shekharhas earned the badge BCA: Password Safe
  • BCA: Endpoint Privilege Management - Linux
    AndyBrithas earned the badge BCA: Endpoint Privilege Management - Linux
  • BCA: Privileged Remote Access
    Sumit Aggarwalhas earned the badge BCA: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Mac
    Ellarthas earned the badge BCA: Endpoint Privilege Management - Mac
Show all badges
Terms & ConditionsCookie settings