Skip to main content

Unanswered questions

45
B
bt101Veteran
 Windows & MacOS
Driver Exclusion - Wildcard support

Hello! I see that driver exclusion does not support wildcards or folder paths and it needs full path of executable. There is idea but it is in Will Not Implement status. Just wanted to understand from community if you have came across this requirement. We have large number of endpoints with EPM W and have seen at least a few apps that have conflicts and need exclusions. msedgewebviewruntime has been a pain as it is located in 3 folders and folder names change at least once per month . Similary some other security tools that may require exclusions in EPM. some have folder paths that include version numbers , some have processes that are similar to PRA (random characters at the end). A lot of other security tools allow this control to admins

10
B
R
RahulBApprentice
 General
How to manage local scan account and functional account step by step

Hello Everyone, I can understand the logic behind the automatic password rotation of local functional account even if we have new server onboarded using same first functional account credentials, but it is untested. i am trying to test it and update it once done. Regarding the Local scan account i actually do not have any idea that how can we manage it (Using enable scanner on managed account i know but what if we have onboarded 100 servers and now we need to scan 100 more and the scan account is using old credentials on remaining 100 servers also if i need to perform the scanning on old scanned assets?)There are lots of questions in my mind regarding the management of local scan accounts.Please feel free everyone to share your recommendations………………………….

2125
B
D
Drew HollingsNewcomer
 Windows & MacOS
Identifying devices that are no longer syncing with the cloud?

During BAU we receive tickets where policy changes are made but the user is still having issues doing x (whatever the change was) and it turns out the device is no longer syncing and therefore not receiving policy updates. This makes me think there’s probably many more out there that we don’t know about. Are there any options when it comes to identifying devices that are no longer syncing with the cloud?

61
J
A
ArnoApprentice
 General
Custom Link

Hi everyone,  Is there a possibility to display a custom link on the registered website at Password Safe, which points e.g. to a helpdesk page? We have documented all the steps in a portal. End users should read the documentation before opening a ticket. Regards

121
H
BeyondTrust Employee
P
prasadp87Trailblazer
 General
Password rotation through API user

Hello All,I am looking for guidance for API script which used for password rotation of any managed account.We are currently using shell script for password rotation, but it seems failing for Invalid user/Password event though password fetch script is working fine for same user.If anyone has sample script, please share or if anyone knows pointer to develop new script for this requirement please help. Thanks,Prasad 

285
H
BeyondTrust Employee
K
Kevin MUApprentice
 General
Feature requirement

Hello, is PASM able to do this : The solution must support backend database activity monitoring, including the ability to capture and log all database updates, including modifications made directly to the backend via SQL queries. The solution must be capable of tracking and recording executed SQL code, with sufficient detail to identify the nature of the changes. The solution functionality must include filtering and reporting capabilities based on date ranges, enabling administrators to view SQL activity executed within a specified timeframe. Thank you.

263
H
BeyondTrust Employee
C
Carlos MendonçaTrailblazer
 General
Password Safe - PWA - Extension BeyondTrust Google Chrorme

Hello, how are you?Please, how can the option be configured to not open this box for the user? The idea would be to only use the extension for auto-filling as I can use with the administrator account.    

152
C
C
Carlos MendonçaTrailblazer
 General
Password safe - Features

Hello, how are you?I need support on how the features in password safe work. What would be the best practice recommendations for the solution and environment? Do you have any documentation? What to enable or not?

162
H
BeyondTrust Employee
W
way2qk4u2cApprentice
 Endpoint Security
Local admin rights required in an AD-HOC way

Hi All,  Currently I’m going through the EPM install / onboard process and was wondering if there is a way to give users local admin rights to install applications on the fly. Some installers just have so many commands to whitelist that this isn’t feasible during a 1 time install. I was hoping for like a “just in time” setup to raise full admin however, the on-prem version doesn’t include JIT setup only the cloud does. How have others accomplish this without the need to whitelist every individual command line? 

404
tclowater
BeyondTrust Employee
P
pvermaNewcomer
 General
Inspect /dev tools on a Web Jump on PRA

Does anyone know if we can leverage inspect /dev tools on a Web Jump on PRA? We have developers trying to inspect and open dev tools on the web page but looks like it doesn’t work?

261
M
BeyondTrust Employee
J
JCBassApprentice
 General
Insights on-premise appliance

When will Insights be available on-premise? For those under compliance rules and laws, cloud based is simply not an option. The product would be very beneficial to compliance and regulatory customers. 

262
J
K
kimberlyvApprentice
 General
Password Safe Propogation Actions: IIS Management Service Delegation

Hello, do you know if there is anything in the works to have managed account credentials also be updated in IIS > Management Service Delegation? 

172
K
R
rrueschjjApprentice
 General
PRA Shell Jump sudu/su and credential injection so that our admins can use sudo without needing to know their password.

In the ideas portal A10-I-249 someone suggested being able to re-inject credentials when running a sudo or su command. The idea was marked as already implemented. Is there any documentation on how to achieve this or can anyone provide steps to accomplish this without setting the sudoers file to passwordless?

223
Paulo144
A
abhatiaApprentice
 General
Onboarding of GCP, Azure and AWS assets

Hi Team, I’ve been trying to find the steps/process for onboarding of GCP, Azure and AWS assets. I’ve seen KBA for onboarding of accounts only from these cloud platforms. Regards,Aditya Bhatia

152
A
S
SanApprentice
 Windows & MacOS
How to uninstall EPM Windows agent, adapter, and package manager via Intune without using GUIDs

Hi all,Can we uninstall EPM components via Intune without using GUIDs in Uninstall Command.After update of every version of components, the GUIDs are changing and Intune doesn't have the capability of auto fetching updated GUIDs.So, are there any constant commands that can be used for uninstallation via Intune?

161
J
J
JasperVeteran
 Windows & MacOS
Remote helpers unable to see UAC prompts on EntraID joined Windows 11

Does anybody use EntraID joined Windows 11 devices with Intune? We have an issue with Remote Helpers not being able to see the UAC prompts when remoting in to other user’s machine as the prompts sit inside the Windows Secure Desktop. I have tried to disable the “User Account Control: Switch to the secure desktop when prompting for elevation” and rebooted my device but still unable to see the message from the secure desktop.

131
J
B
Binoy_DeyNewcomer
 Windows & MacOS
Can Privilege Management for Windows policy control User Account Control settings?

I am trying to modify User Account Control (UAC) settings on my test device where BeyondTrust Privilege management (BTPM) components (client, adapter, and package manager) are installed and running as expected. I am trying to set UAC as ‘Never notify’ but I am getting an error which says, ‘You must be logged on as an administrator on this computer to select this setting’. I am attaching the screenshot as well.This is required to be modified by few users in our environment for application installations, running scripts etc. Can anyone let me know if this modification of UAC settings can somehow be accommodated in BTPM Policy?

161
J
S
SFARising Star
 General
PRA-DATA AT REST ENCRYPTION INBUILT AVAILABLE?

Hello is there data at rest encryption available in PRA inbuilt? or need to configure with key management solutions? Found whitepaper etc but it just mentions steps to integrate with KMS.

161
A
BeyondTrust Employee
A
Avishka VithanageApprentice
 General
CISCO 'Enable' Password Management

We have a requirement to onboard Cisco devices into Password Safe. For privilege escalation, we need to use the 'enable' secret. The non-privileged user account and the enable secret use separate passwords.Is there a way to manage this scenario in Password Safe?

282
A
T
timbrigham-ocApprentice
 General
Netbios name when connecting via PRA not available?

Can the netbios name be made available for PRA and Password Safe, not just the domain name? domainname\username doesn’t work on all applications; some legacy platforms it has to be the netbios name. 

577
T
M
MudupuriApprentice
 General
On Privilege Remote access how can I link the Session policy to a bulk group policy with the help of API. I do not see any parameter of Session policy in Group policy

On Privilege Remote access how can I link the Session policy to a bulk group policy with the help of API. I do not see any parameter of Session policy in Group policy

81
R
BeyondTrust Employee
N
naveen_muduNewcomer
 General
Linking of Assets, Accounts & applications

I have a use case where we are using the domain accounts for accessing Network devices and windows. Say abc.domain@domain.com which is linked to a network device, Windows and an application. Similarly abc2.domain@domain.com, abc3.domain@domain.com. Linked with all the Network device, windows and application.I have done the linking of the managed accounts to systems (Network device, windows and application.)I have configured in the managed account smart rule mentioned that Managed account field=abc.domain@domain.com & Asset smart group= Windows. in the condition i have given the show managed account as smart group. Also mapped the user group to this smart group.We have also got applications which are running with the same account abc.domain@domain.com. applications are in Windows, network devices.We are able to see in the directory linked accounts it is showing only windows which is as expected and the account abc.domain@domain.com. But when seeing in the applications it is showing

271
J
BeyondTrust Employee
M
mcencienzoRising Star
 General
Difference between Scheduled Password Change and Force Change Password

Hi, Does anyone encountered scheduled password change fails due to permission denied error however if you use force change password, it successfully changed the password? The system is Ubuntu and I wonder, what’s the difference between those 2 functionality. The account settings option for the Ubuntu managed account is configured to use a functional account when changing password and Use Own Credential is disabled. If I try to simulate the changing of password on the server, the passwd <managed account> command doesn’t work due to an error showing “passwd: You may not view or modify password information for <managed account>”. If I run the command, sudo passwd <managed account>, it requires us to input the sudo password. With this two commands unable to work properly, I wonder why the force change password works? Any idea?  Cheers~!

261
J
BeyondTrust Employee
B
bpkothariApprentice
 General
Comparison between Privileged Identity and Password Safe

Need Comparison between Privileged Identity and Password Safe (including features, scalability, audit, troubleshooting, integration, APIs, architecture, User Interface etc etc? Is there any refernce document available to higlight why its a better than PI to management?

191
H
BeyondTrust Employee
S
SathishNewcomer
 General
how to setup email notifications to the service account owners once the password is rotated in password safe

We have the following use case:  Onboard the service account to password safeNotify the service account owners with the new password when the password is rotated in password safe. The password need to be communicated to the service account owners for any external service account usage beyond password safe  The service account password should be updated by the password safe on the underlying windows services/scheduled tasks/ IIS application pools.I would like to understand the feasibility on the email notifications, password updates on the services and any challenges that anyone faced while onboarding the service accounts. 

1063
H
BeyondTrust Employee

Badge Earners

  • BCIE: Password Safe
    Lakshmi Parvathihas earned the badge BCIE: Password Safe
  • BCIE: Privileged Remote Access
    1000Wasserhas earned the badge BCIE: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Mac
    vimal88has earned the badge BCA: Endpoint Privilege Management - Mac
  • BCSE: Privileged Remote Access
    Kevin MUhas earned the badge BCSE: Privileged Remote Access
  • BCA: AD Bridge
    ErenYenerhas earned the badge BCA: AD Bridge
Show all badges
Terms & ConditionsCookie settings