Recently active topics

I have a hybrid environment where my on-prem AD group accounts are created and then later on syncd to Entra ID. When I add one of the syncd groups, the filter does not get applied at all. Does anybody know how EPM checks for which group a user belongs to? I tried creating a separate Entra ID cloud group and added myself as a member, got the sync completed via the API, then added an account filter using this group, still does not get applied. What am I missing?

Hi All, We have migrated from one Password Safe appliance to another, as part of the migration, we moved the sessionmonitoring folder to the new appliance, with all the recordings. Database is migrated successfully; I can see all the Completed Sessions on the portal. When I try to view any session recording which is migrated from old appliance, getting below error: New appliance name is different from old one. Any advice to fix the issue? Thank you.

This might be a bit too big of a question for this forum. However, I am not sure where to start. We are still somewhat new to PRA. I am wanting to start using Docker containers for our jumpoints instead of putting them on Linux instances. First, where do I go to download the container image? I heard that there is a stock image that we would use and then just input the key to start the connection to our system. Second, can we put the container in a service like AWS container service or Azure container service? Third, and this will show my very beginner level of experience with containers, would we do the firewall rules for the containers the same way that we do them for the Linux servers that are jumpoints?I have a feeling there are other items that I am totally missing, but I figured this is a good start. If you know of documentation you can point me to I am more than happy to start reading and testing things out. 

Hello everyone,We have encountered a challenging requirement during our discovery scans for a range of IP addresses. In the scan results, some assets appear with their asset names as IP addresses instead of hostnames.We need to filter out these assets and prevent them from being added to Password Safe. Does anyone know how we can filter out assets without hostnames that are still being added to Password Safe? Thank you,Prasad

Dear Team,I need your assistance with onboarding an MSSQL database into Password Safe using the application-based method (credential injection or API-based access). The goal is to allow applications to retrieve SQL Authentication credentials from Password Safe, rather than directly onboarding the database as a managed system.Could you please provide the relevant documentation, configuration guidelines, and example .ini files needed to set this up?Additionally, we would like to configure this setup for the following RDS (Remote Desktop Services) server environment: [Include your RDS server requirements or details here if applicable] Your guidance on the setup process, including best practices for securely retrieving and managing SQL credentials through the application, would be highly appreciated. 

Hey everyone, we’re running into a strange issue with the Remmina RDP client and BeyondTrust Password Safe on Linux, and I’m wondering if anyone else has seen this or found a workaround. What’s happening When users download one-time RDP connection files from Password Safe and open them with Remmina, the connection doesn’t go through automatically.Instead, Remmina asks users to re-enter their Password Safe credentials (the same ones they already used to log in to PWS) before the RDP session actually starts. What we’d expectIdeally, the RDP session should just launch automatically, using the credentials passed from Password Safe — no extra prompt.Environment RDP Client: Remmina 1.4.41 (latest) BeyondTrust Product: Password Safe OS: Ubuntu, Fedora, RHEL, and other GUI-based Linux distros  Extra contextThis only seems to happen on Linux — the exact same workflow works perfectly on macOS and Windows, without any re-authentication. Questions  Is this extra prompt expected when using Remm

Hi all,I have onboarded winscp as an application in beyond trust. it is working fine however there is some delay before hostname username and password are injected in respective fields. can anyone please let me know how to resolve this issue. Regards Imran

We have created the Local account on Custom Platform /Linux system mapped it user one-to-one since We cannot mapped it dedicated since user's Admin account and Requestor id is not matching . Below is scenario, 1. User Admin id is PA091922. user's Requestor Id :MSP9192 Since users Requestor id and Admin Id are not matching , we have mapped this using one to one so that user can login to BT and should see this id ->PA09192This mapping is working fine and user is able to see this Id. However problem here is When any user , having Admin access, logs in to BT, they are also able to see  this id -PA09192. Below KB article explains the reason but we dont want Admin to view and access this id https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sys_kb_id=4b4c8e7f473f5a541bf1db37536d434a Can anyone please let me know how can we block Admin users from viewing non dedicated mapped/Shared id from viewing and accessing from Password Safe. Regards,Imran Aiyani

Context: MCP stands for Model Context Protocol, an open standard that provides a standardized, reusable way to add tools to LLMs.  In this short video, we can see how easy it is to leverage the Remote Support preview MCP server from within Claude Desktop, to allow a user to interface with Remote Support and start a Remote Support Session with a Support Representative. The Remote Support preview MCP server is available here for authenticated users:   

Hello Beekeeper Community,I’m curious to hear how others handle the following:Onboarding:easy: AD query, smart rules, and we have managed account. Offboarding:When a managed account deleted from AD , the password can’t locate the user. Also, there doesn’t seem to be a smart rule capability to identify which accounts are in Password Safe and which are not, to help with automated cleanup and management.How do you manage this process? Any tips or best practices would be appreciated!Regards,Maulik

Hi Experts! We’re slowly growing our user base in the Password Safe pilot we’re running. Since last week, non of our users are able to see their T0 accounts.The administrators were able to search for the accounts in the Password Safe module last week, but since Friday the cap of 1000 accounts were reached. Any suggestion on how to make the accounts visable? We have them as managed accounts in the managed accounts module, and they’re picked up by the smart rules that are identical to T2 and T1 accounts. We run a tierd model where rdp access is granted on T2, local/server admin is granted on T1 and domain admin is granted on T0. So each user can have up to 3 personal accounts per domain. Best regards,Joakim Andersson

Hi All,I am currently exploring options to onboard more than 1500+ Active Directory (AD) objects from an AD domain without using AD groups.I have developed a sample PowerShell script that uses the BeyondTrust Password Safe (BeyondInsight) REST API to import AD managed accounts in bulk.Using the POST API endpoint, I am successfully able to create multiple managed accounts under a Windows platform managed system (entry type: Asset). The script works as expected for Windows systems.However, when I try to use the same API for a Managed System of platform type Active Directory (entry type: Domain), the API call fails with an HTTP 400 (Bad Request) error.Could you please confirm if the same POST API endpoint is supported for creating bulk Active Directory managed accounts under a Domain-type Managed System?If not, please suggest the recommended approach or alternate API for importing AD accounts in bulk under the Active Directory managed system.

Context: MCP stands for Model Context Protocol, an open standard that provides a standardized, reusable way to add tools to LLMs.  In this short video, we can see how easy it is to leverage the Secure Remote Access preview MCP server from within Claude Desktop, to allow a user to investigate Active Sessions and Terminate a session for a remote worker involved in a security incident. The Secure Remote Access preview MCP server is available here for authenticated users:  

Installing the Linux Remote Support jumpclient in system mode breaks our GDM authentication configuration by installing the file /etc/dconf/profile/gdm with the contents:user-db:user system-db:gdm file-db:/usr/share/gdm/greeter-dconf-defaultsRedHat systems configure gdm by default via the dconf site database. RedHat expects a confguration like:user-db:user system-db:local system-db:site system-db:distro By removing the local, site, and distro DBs you are completely breaking the standard RedHat configuration. This is completely irresponsible on your part to be modifying such a critical system configuration. This took most of my day to resolve and locked a couple of users out of their machines for a few hours.I had actually just decided to enable your automatic updating of Remote Support - but that is out the window now if you are going to be releasing stuff like this.

Hi All,I want to onboard WinSCP as an application in Beyondtrust password safe. If any one has worked on similar task or onboarded WinSCP as application, can you please  help me here?I want to understand how will the .ini file be created for it . I understand hostname, username and password I can pass it through Application configuration from PAM , But unable to understand how can I render those values on application launch.Awaiting reply . thanks in advance. Regards,Imran Aliyani

Hi all Does anyone has the same issue with Jump Policies set directly on Jump Items not having an effect.In general, we set the Jump Policy on Jump Groups via a Group Policy so each Jump Item within that Jump Group gets the same Jump Policy. There is the ability to set a Jump Policy directly on the Jump Item which should take effect for this single Jump Item and overrite the Jump Policy assigned by the Group Policy. It looks like in the version 25.1.4, 25.2.1 and 25.2.2 this does not work anymore. Has anyone else the same issue?

The following articles were published last week. New Knowledge Base Articles: KB0021693 - Jump Client screen share graphic issue (artifacting) when no monitor is connected to the machine (headless) - Not refreshing screen KB0021780 - SEC_ERROR_EXPIRED_CERTIFICATE error when accessing appliance through Firefox browser KB0022133 - Unable to create new Jump Client. Error - The total number of deployable Jump Clients for this site has been reached KB0022749 - Remote Support for Android devices not functioning since ONE UI update Android 15 KB0022784 - Privileged Remote Access and Remote Support 25.2 operating system certification matrix KB0022958 - Multiple warnings appear during Jump Client installation on Linux machines "Failed to start transient service unit" KB0022964 - Certain features are not working during session when using BeyondTrust Support app on Android KB0022966 - Annotations

The following articles were published last week. New Knowledge Base Articles: KB0021693 - Jump Client screen share graphic issue (artifacting) when no monitor is connected to the machine (headless) - Not refreshing screen KB0021780 - SEC_ERROR_EXPIRED_CERTIFICATE error when accessing appliance through Firefox browser KB0021808 - Vault interface not pulling in Password Safe connected credentials through ECM integration when executing SQL Tunnel in Privileged Remote Access KB0022133 - Unable to create new Jump Client. Error - The total number of deployable Jump Clients for this site has been reached KB0022784 - Privileged Remote Access and Remote Support 25.2 operating system certification matrix KB0022958 - Multiple warnings appear during Jump Client installation on Linux machines "Failed to start transient service unit" KB0022961 - PRA Password Safe connection error "Error validating connection inf

The following articles were published last week. New Knowledge Base Articles: KB0022810 - Windows Terminal prompts UAC instead of EPM-W message KB0022978 - What is the Matched as Child Process filter? KB0022987 - Message name updates for previous events in Analytics KB0022988 - Entra ID group filters are not applying after upgrading to EPM Cloud 25.7

The following articles were published last week. New Knowledge Base Articles: KB0021528 - Direct connect RDS sessions fail when using 2016 RDS servers with TLS 1.0 disabled KB0021684 - .NET updates missing from Supporting Software or SUPI updates KB0021768 - BeyondTrust Discovery Agent not working - btdiscovery testc returns: Error 401: not authorized KB0022557 - Password Safe DSS Keys FAQ's KB0022558 - Does Password Safe rotate Linux Managed Account SSH Private Key and Public Key ? KB0022559 - Why was the old SSH public key not removed from authorized_key after key pair regeneration in Password Safe? KB0022971 - Can Defender be pointed to an internal Microsoft Defender console for updates? KB0022981 - How to configure the U-Series appliance as an Enterprise Updater Server KB0022982 - Can a penetration test or vulnerability scan be performed against my U-Series appliance?

The following articles were published last week. New Knowledge Base Articles: KB0021668 - Server login error - /usr/bin/id: cannot find name for user or group KB0021721 - The adtool command fails to return all ACLs and computer objects when host name is greater than 15 characters KB0022959 - GPO update is failing with error: "lsass: [lsass] Cache could not be emptied because domain domain.name is offline [9502]"

Hello Experts, One of my customer unable to see the submit request to check out the password from PAM. what could be the issue and how to trouble shoot this.

I understand I can see the last modified date on a secret in Secret Safe. If I modified anything on the secret notes, url, etc, it will show the last modified date for the secret. However, I need to see the date when the password was changed.Has anyone been able to figure this out?

We are looking for new ways to upgrade our BTRS environment due to after every update we face new issues we like to avoid. This time due to our deployment through Microsoft Intune we had several file detections in place which all have been made obsolete due to drastic changes in the install behaviour of the Jump Client into new directory and other file changes inside, causing an automated reinstallation of the jump client duplicating and consuming more licenses until of course we run out of licenses. In the past we always did uninstall and install where we also had auto update on causing extreme license consumptions which we try to avoid. If the application is still properly detected even updated or not, it will not trigger a new install and does not duplicate a license, in 1 case I even found a device consuming 29 licenses because it kept trying to install and not detected retriggering the install. The last time we did not use so called Intune supersedence and tried to stay within the