Skip to main content

Unanswered questions

42
S
SFARising Star
 General
how to run powershellscript to change password

Hi I have application API to change password , how can I use it to trigger password change via PAM. For using application host, I am unable to use WINDOWS system . I found this link here-Resource Kit SDK Plugin for PowerShell Scripts -Should I go with above? or propagation action? If using propagation action, what needs to be the platform? I mainly want to do trigger generation of password based of password policy, update it just in the BT DB and not try to apply in system account. I have a windows system with the script and want to trigger change of password from BT .  

70
S
A
AyanWSTrailblazer
 General
Extended RDP session - 2-4 days

Team,I am curious to know whether it’s possible to extend/allow RDP session for more than 2 days. Concern team wants to perform a job and they might need to keep the session active for about 2 days at least. Is it something we can leverage from BI console? Please suggest.

492
A
P
prasadp87Trailblazer
 General
How to add scanned account as Managed account

Hello All,I have quick question about Beyond trust discovery scan accounts. We have configured scanning for certain servers accounts. When I look into scanned asset, I am able to convert “unmanaged” account from General data section but I dont see option to convert “Users” shown in Scan data section. Does anyone know how we can get these users in Managed account list.   

111
H
BeyondTrust Employee
T
Tina_KTrailblazer
 General
Session gets lost if remote computer is offline too long

Hello again,sometimes a support session gets lost or “broken” if the remote computer is offline for too long. (For example because it is making a BIOS Update that takes very long… or the user does not return to reboot for a while) The supporter can only End the session in this case and has to make a new one if the customer returns. Screen sharing controls turn grey and only “close” is available.Is there a way to set the timeout for “customer left session” higher so the session does not get lost?I did not find anything in the admin console or the knowledge base...

202
T
A
Anil ReddyApprentice
 General
virtual appliance deployment on vm for passwordsafe on prem

HI All, Planning to configure on prem virtual appliance on VM new server to deploy the BI and passwordsafe.Can you share any one the article to start the deployment step onwords ,how we can go head to complete this new setup for testing purpose we are planning to deploy only one appliance. Thanks 

214
Prudhvi Keertipati
P
prasadp87Trailblazer
 General
Can NTLM be disabled for Beyond Trust.

Hello Team,  We have received a requirement from our security team to disable NTLM for Beyond Trust. We are using Beyond Insight Password safe and U series appliance.I have seen few of the topic which discuss about same but not sure if we still can disable NTLM and it won't break anything.  Some of the reference topics are -Endpoint Privilege Management - Can EPM policy be configured to deactivate NTLM ?BeyondInsight / Password Safe - NTLM is being deprecated; can it be removed from U-Series appliances? Please suggest. Thanks,Prasad 

435
P
C
Carlos MendonçaTrailblazer
 General
Password Safe - Managed Account

Hello,Please, how do I synchronize user accounts in the domain to managed accounts? To have visibility of all user accounts and rotate the password if necessary.  

273
Prudhvi Keertipati
P
pphung301Apprentice
 Windows & MacOS
unnapproved Updates to Microsoft Teams

Hi, I am getting a prompt of an unapproved app and after looking into it in Analytics, it seems to be from Microsoft Teams updates which does not carry a Publisher so its unsigned.  Whats the best way to allow this since there is no signed info for this?   ApplicationApp DescriptionPublisherOn DemandNoApplication TypeInstaller PackageFile PathExecutable Pathc:\program files\windowsapps\msteams_25153.1010.3727.5483_x64__8wekyb3d8bbwe\ms-teamsupdate.exeCommand Line"C:\Program Files\WindowsApps\MSTeams_25153.1010.3727.5483_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 9e3e64d2-2229-4fc7-90dd-70234b468a6b -Trigger EnsureTmaAtStartupApp NameApp VersionFile VersionHash SHA1Hash SHA256Hash MD5File Owner NameProduct CodeUpgrade Code{97F40CEA-BEDE-40ED-A9A3-9354C8E64392}Download URLBeyondTrust ZoneDrive TypeElevation MethodAdmin accountPolicyApplication DescriptionAny MSI Installer PackageApplication Group Name(Default) Any Signed UAC PromptMatched as Child Proce

534
P
B
bpkothariApprentice
 Secrets and Non Human Identities
Password Aging in Password Safe Secret Safe

We are facing a common challenge in password vaulting systems where the password age isn't directly tracked, and the password hash changes even when unrelated attributes are modified. This makes it difficult to determine when the password was last changed.Problem SummaryNo dedicated timestamp for password change. Password hash changes even when non-password attributes are modified. You need to detect passwords older than 2 years to raise a security finding. How to solve this in secret safe?

183
B
R
Raja SekharApprentice
 General
where to find scheduled password change logs

Hi Team,  Please help me to find out the logs of the scheduled password change on UVM. Best Regards,Raja Sekhar L.

2753
B
N
NectarNinjaApprentice
 General
RDP Failed Tested pretty much everything...

Hi everyone, hope you are doing well.Recently, we’ve been doing some testing and scratching our heads since its impossible to succeed.We’re attempting to connect to an Asset using Passwod Safe RDP session, but the PBSM log message shows as follows:#######################################################################2025/06/27 11:47:45.577 531988 523196 INFO: RDP Handler 531988 starting2025/06/27 11:47:45.592 531988 523196 WARNING: Could not open HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\SslBindingInfo\0.0.0.0:443 0x22025/06/27 11:47:45.592 531988 523196 INFO: Reading self signed cert2025/06/27 11:47:45.795 531988 534272 INFO: (RDP server) Client Security: NLA:1 TLS:1 RDP:02025/06/27 11:47:45.795 531988 534272 INFO: (RDP server) Server Security: NLA:0 TLS:1 RDP:02025/06/27 11:47:45.795 531988 534272 INFO: (RDP server) Negotiated Security: NLA:0 TLS:1 RDP:02025/06/27 11:47:45.858 531988 534272 INFO: (RDP server) Accepted client: CVLP-JPALACIN2025/06/27 11:47:45.858 531988

334
Paulo144
P
prakash.rApprentice
 General
Caching Issue with Web Applications via Password Safe and Microsoft Remote Desktop on MacOS

Hi,{This issue is only applicable to MacOS environments}Is anyone facing an issue where, when launching a web application (using PSautomate) via Password Safe in MacOS using the Microsoft Remote Desktop application, there is some sort of caching issue? For example, let’s say I download the RDP file for a web application at "https://app1.example.com"; the Microsoft Remote Desktop will prompt an “RDP certificate warning,” and the user will click "Continue," allowing the browser and web application to launch successfully. Example of “RDP Certificate Warning” However, once they close this web application browser (browser only and not the entire Microsoft remote desktop app) and launch another web application session (such as "https://app2.example.com") using a new RDP file downloaded from the Password Safe portal, it doesn’t prompt the “RDP certificate warning” and instead launches the old web application ("https://app1.example.com") session instead of the new one, even though we clearly l

160
P
nemer.scafutto
nemer.scafuttoApprentice
 General
Concurrent Web Jump Limit

Hello,I have a customer who is having a question about the Vendors section of the PRA.In the customer's environment, there is only one group of Vendors, and they are complaining that they can only perform Web Jumps in 3 sessions simultaneously. Is this the limit or is there a way that can be configured so that they can perform more jumps?

342
Paulo144
M
mjhallVeteran
 General
Renewing Remote Support Certificates - Best Practice

Hello,We are coming up to our certificate renewal, and I noticed that the BeyondTrust documentation states “You do not need to create a new certificate request”, and to provide the original CSR if the CA doesn’t already have it.  See DigiCert documentation, “Best practice is to generate a new CSR when renewing your SSL/TLS certificate. This creates a new, unique keypair (public/private) for the renewed certificate.”  Why would BeyondTrust, a company developing security products, recommend a less secure process? Am I misunderstanding something, or should the BeyondTrust documentation follow industry best practices for renewing certificates which is to generate a new CSR in order to create a new keypair? 

211
L
H
HamzaTrailblazer
 General
PRA Base 7.4.0 Supports PRA Site 24.x.x

can we only upgrade PRA base to 7.4 while on 24.x.x or it’s must to upgrade PRA site to 25.x.x after upgrading Base to 7.4 ?

191
P
BeyondTrust Employee
R
RidwaanKApprentice
 General
Registered API usage reporting

I would like to enquire about api’s that we have registered on password safe how do we report on the activity. Example of what we require .If we create a API for a service account for example that is used by postman how do we report on the usage of the api . The reason is is the api that is registered is not is use we want to clean up .

153
H
BeyondTrust Employee
A
AndyHTrailblazer
 General
How to add a discovery scanner?p

Hello, we have 2 U-series Appliances for HA. On the “Asset” section, Appliance1 was shown as “discovery scanner”. However, Appliance2 is not “Discovery Scanner”. When we swap the active appliance to Appliance2, all discovery jobs are failed. How could we add the Appliance2 to “Discovery Scanner”? Thanks,

202
A
Arno
ArnoApprentice
 General
Local Drives in a RDS-Connection

Hi everyone,with a standard RDP connection, I can share and use my local drive in the connection.Is this also possible with a PWS connection, and can I set it as the default for certain connections?And what about applications that run on the RDP server? Some applications require data files that I would like to save or load. Regards Arno

131
Paulo144
C
cmscottRising Star
 Windows & MacOS
EPM Reporting Database on a remote database

Can the EPM Reporting Database be configured on the same remote database created in an active/active configuration? Thanks

111
H
BeyondTrust Employee
S
suhail.salimNewcomer
 General
Password safe user license details

Is there any way we can get the user license count from the password safe?We need to know how to check how many licenses are utilized. 

3305
Chitta2019
K
Kevin MUApprentice
 General
PASM capabilities

Hello,  Can PASM support backend database activity monitoring, including the ability to capture and log all database updates, including modifications made directly to the backend via SQL queries ? Is it capable of tracking and recording executed SQL code, with sufficient detail to identify the nature of the changes. The functionality does include filtering and reporting capabilities based on date ranges, enabling administrators to view SQL activity executed within a specified timeframe ?

261
Q
BeyondTrust Employee
M
MRossiNewcomer
 General
Strange behavior of network tunnel jumps after upgrading to 25.1.2

Hi all,we upgraded our PRA cloud instance from 24.3.x to 25.1.2 one week ago.After the activity we are facing some issues in connecting to our resources using network tunnel jumps. No modification of configuration of firewalls, network, jumpoint and jump items. Starting a debug activity, errors that occurring are the following:IPT:ERROR>Exception enumerating filter rules while getting IP address for name server pointers. failed to convert IP address stringException - failed building the DNS PTR list Do we need to create lookup zones and PTR record for every target that we need to reach through network tunnel jumps? No issues before the upgrade. Thanks in advance,Massimo

281
P
BeyondTrust Employee
X
xNourahxApprentice
 General
Active Directory windows app

Hello,Has anyone successfully configured RemoteApp access to Active Directory?I'm trying to publish the "Active Directory Users and Computers" tool as a Windows application, but I haven't had any luck so far.I assumed it would be straightforward, and I'm using the following application command:%SystemRoot%\system32\dsa.mscI suspect the issue is that it doesn't accept .msc file types and might require an .exe file instead.Any ideas or suggestions?

463
rhagerm
M
MassimoGApprentice
 General
Automate Login and Jump Tunnel

Hi everyone,I'm looking into ways to automate some actions with BeyondTrust PRA. Specifically, I'm wondering if anyone has managed to: Automatically log in to the BeyondTrust console Launch a "Tunnel" type Jumpoint automatically, without manual intervention. The goal would be to have a script or integration that, once authenticated, can open a tunnel through a pre-configured Jumpoint — useful for automations or third-party tool integrations.Has anyone done something similar, or knows if this is possible using the BeyondTrust API or any other method?

152
P
BeyondTrust Employee
B
bt101Veteran
 Windows & MacOS
Driver Exclusion - Wildcard support

Hello! I see that driver exclusion does not support wildcards or folder paths and it needs full path of executable. There is idea but it is in Will Not Implement status. Just wanted to understand from community if you have came across this requirement. We have large number of endpoints with EPM W and have seen at least a few apps that have conflicts and need exclusions. msedgewebviewruntime has been a pain as it is located in 3 folders and folder names change at least once per month . Similary some other security tools that may require exclusions in EPM. some have folder paths that include version numbers , some have processes that are similar to PRA (random characters at the end). A lot of other security tools allow this control to admins

1102
B

Badge Earners

  • BCIE: Password Safe
    LuanCarneirohas earned the badge BCIE: Password Safe
  • BCA: Password Safe
    Shekharhas earned the badge BCA: Password Safe
  • BCA: Endpoint Privilege Management - Linux
    AndyBrithas earned the badge BCA: Endpoint Privilege Management - Linux
  • BCA: Privileged Remote Access
    Sumit Aggarwalhas earned the badge BCA: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Mac
    Ellarthas earned the badge BCA: Endpoint Privilege Management - Mac
Show all badges
Terms & ConditionsCookie settings