BeyondInsight / Password Safe

Hi All,I want to onboard WinSCP as an application in Beyondtrust password safe. If any one has worked on similar task or onboarded WinSCP as application, can you please  help me here?I want to understand how will the .ini file be created for it . I understand hostname, username and password I can pass it through Application configuration from PAM , But unable to understand how can I render those values on application launch.Awaiting reply . thanks in advance. Regards,Imran Aliyani

Hi all,I have onboarded winscp as an application in beyond trust. it is working fine however there is some delay before hostname username and password are injected in respective fields. can anyone please let me know how to resolve this issue. Regards Imran

Hi All, I am trying to explore options for bringing in 1500+ AD objects from AD domain without using AD group option (I agree which is best and most suitable option). Kindly help to share if there are any other options to achieve this apart from using AD group.   

Hello Beekeeper Community,I’m curious to hear how others handle the following:Onboarding:easy: AD query, smart rules, and we have managed account. Offboarding:When a managed account deleted from AD , the password can’t locate the user. Also, there doesn’t seem to be a smart rule capability to identify which accounts are in Password Safe and which are not, to help with automated cleanup and management.How do you manage this process? Any tips or best practices would be appreciated!Regards,Maulik

We have an attribute “employeenumber” from on-premAD which is syncd to Entra. Was trying to use this for my directory attribute match for the privileged access but on the drop-down selection in BeyondInsight, it only shows “employeenumber” as the attribute name but the actual Entra attribute name is supposed to be “extensionattribute_<appreg_clientID>employeenumber”. Is there a way to map this to an on-premAD “employeenumber” attribute but use Entra for my requester group? I am just not sure if it PS will recognize it since it s trying to map the requester (from Entra SAML SSO) against the  on-prem AD attribute.

The following articles were published last week. New Knowledge Base Articles: KB0021657 - LDAP directory credentials error: The credentials entered failed to validate - How to create bind credential for LDAP server such as Redhat IDM KB0021660 - Editing an Active Directory user in User Management error - There are one or more invalid fields KB0021678 - Unable to delete Inactive Scans from the web console KB0022823 - Unable to receive application audit events after upgrade KB0022917 - What is a login account for SSH and how is it configured in Password Safe KB0022930 - Error when trying to rotate password with custom platform NetApp - command failed: Authentication failed KB0022969 - BeyondInsight Configuration (rememconfig.exe) tool Start Service not working - Services not starting KB0022970 - Password Safe integrated WPE fails to create policy from template nothing happens when clickin

Hi ALL,We have requirement to enable form Login for 2000 users in Password Safe. From BT portal, there is no bulk update option available .I am looking for any API if available then we can use it for bulk update and enable form login. I know alternately we can reach to BT support team and get it done from Backend. However we want to explore first if any API is available to achieve this.Can anyone please let me know if any REST API available that I can use and update the user profile .Awaiting for response. thanks in Advance.  

What are the best practices for configuring managed accounts for non-privileged access?For example, 200 developers who need access to multiple servers.What is the recommended best practice in this scenario?Specifically: Should each developer have an individual non-privileged domain account?Is there a better approach for managing a large number of non-privileged users accessing multiple servers (e.g., using groups, role-based access, PAM, etc.)?Very important: We do not want one developer’s session to be accessible or “stealable” by another developer.Looking for guidance on how organizations typically handle this setup securely and efficiently.

Hey Community, I’m looking for a way to manage service accounts via automation from Password Safe that will update credentials for service accounts that are used on Canon copier models MDF iR-ADV C5860 & MDF iR-ADV C5850. Is there a way to do this? I believe they use a proprietary OS called MEAP and their documentation is not very robust. Thanks!

Common challenges with PasswordSafe User Provisioning comes down to the confusion between Smart Rules and Smart Groups, and the concept that PasswordSafe groups are only provisioned if they have permissions assigned to them. You cannot give access to users who are in a group with no permissions.  📌 If you’re wanting an overall yes/no flow if a user can access PasswordSafe or a managed account, please see Whiteboard Workflow Diagrams for PasswordSafe Authentication and Permissions | Community In the effort to share the knowledge, I’m sharing the raw whiteboard notes I have around an approach to thinking about PasswordSafe User Provisioning. Whiteboards are my first step in understanding any system, and, quite frankly, I’ll never get this article posted if I were to transpose this into writing.  🚩 This is a general case. There are different ways of altering what a user is provisioned to access by using the PasswordSafe configurations.  PasswordSafe Users need a provisioned reasonPasswo

We have an administrators group for each server in AD. Each member of this group has the local administrator rights for the respective server due to their membership. The servers are all in the same OU in AD. Unfortunately, nothing can be changed to the AD structure in the foreseeable future.We now want to onboard the Windows servers in the PWS. For compliance reasons, we have to work with named accounts on the servers.What is the best way to onboard the approx. 500 servers and the 300 managed linked accounts now?Creating a smart rule for each server, each administrator and then creating a mapping rule is not really a solution, is it?Regard Arno

Why the Whiteboard? Do I have access to PasswordSafe? Can I access the managed account?Why the Whiteboard?PasswordSafe has some ✨ nuance ✨ around authentication that can be a bit different than people are used to. The API tokens, on their own, aren’t permissioned, and accessing via API won’t always show what’s available in the web console. There’s a difference of accessing PasswordSafe and access a managed account. Because of that, I used a whiteboard to show the generic workflow that covers the basics for PasswordSafe access. After sending this to a few people as I find it easier to explain the different components that impact access, I'm posting this here in the event others find it useful.  Do I have access to PasswordSafe?The first question is “can I log in?” and … that depends! This doesn’t cover Pathfinder, Secrets Safe, Secrets Cache, UVMs, or Features. Nor is it covering OAuth2.0 and Application Users. This is meant to be a general guide.  A workflow of “Do I have access to Pas

The following articles were published last week. New Knowledge Base Articles: KB0022709 - Some or all users receive the error "Page not found" when trying to login to PS cloud via SAML KB0022883 - No events showing for IIS App Pool service account propagation action in Password Safe KB0022915 - How to view the expiry date and serial number on U-Series Appliance KB0022935 - Unable to RDP to U-Series appliance "An internal error has occurred" "A fatal error occurred when attempting to access the TLS server credential private key" KB0022937 - ECM integration fails to connect to RS "Could not negotiate HTTP protocol upgrade" KB0022945 - API script error 403 - "Managed Account does not have API access"

Hello Everyone,We are currently developing API scripts to automate some functionalities within BeyondTrust. As part of this effort, we seek guidance on an API script that can provide comprehensive information about a user group.We are aware of the "GET UserGroups" API, but it does not include details about assigned users, Smart groups, and enabled features. Although we know there are separate calls to retrieve this information individually, we are looking for a way to obtain all this data in a single call. Thanks,Prasad

Hi, Does any one know about, how to onboard the dedicated domain accounts without having a AD account group which will be used in directory query and all the accounts are placed in a different AD OU path.    Thanks in advanced!!Gayatri B  

Hi All,As per the KB articles from customer portal, It seems like time in appliance and has to match the time on clients (user mobile devices) for TOTP 2FA to work. How this will work when the users are in different time zones not matching with appliance time zone?

Has anyone had an issue where all of sudden managed accounts are not mapping to their user accounts with smart rules? I have smart rules to map the account, I haven’t done any changes to the managed or non-managed accounts in AD but it just all of sudden stops mapping. It seems like the smart rule isn’t reading the directory attributes either. 

We are uploaded OVA file in Nutanix Platform via Prism Console, post booting VM we are getting Boot device not found. Please install an operating system, or play 2048.We kept disk as a first boot, still we are getting same error message while booting VM.Package Name: 2024-R06-Win22-Ntnx-SF.ovaNutanix Version: 6.5.3.6 LTS Has anyone has done Password Safe deployment on Nutanix Platform. 

Hello, how are you?Does anyone know how to access the product videos or recorded webinars to watch?Do you have a link, please share it.Thank you very much!

The following articles were published last week. New Knowledge Base Articles: KB0021542 - Password Safe Cloud - RDP session error "Remote Desktop can't find the computer" KB0022821 - ERRINFO_RPC_INITIATED_DISCONNECT_BY_USER KB0022884 - ERROR: Failed to login. Status code: 401 Message: "Failed to authenticate due to one or more authentication rules." KB0022903 - Unable to connect to RDP from macOS Windows App. Error code: 0x104 "Unable to connect" KB0022918 - GET ManagedAccounts API call not returning all the managed accounts KB0022927 - How to create a read-only administrator in Password Safe

We are looking into a way to have Password Safe manage the local admin account for RS and PRA.  Right now we have to set calendar items to remember to go in and reset the password to a new one.  Has anyone come up with a good way to accomplish this?  So far we are striking out.  I would have thought Password Safe might have something native for the Beyond Trust products, but that does not seem to be the case.  Looking for some insight.

Hello Everyone, I can understand the logic behind the automatic password rotation of local functional account even if we have new server onboarded using same first functional account credentials, but it is untested. i am trying to test it and update it once done. Regarding the Local scan account i actually do not have any idea that how can we manage it (Using enable scanner on managed account i know but what if we have onboarded 100 servers and now we need to scan 100 more and the scan account is using old credentials on remaining 100 servers also if i need to perform the scanning on old scanned assets?)There are lots of questions in my mind regarding the management of local scan accounts.Please feel free everyone to share your recommendations………………………….

Hi all,I am just curious, how does everyone handle the issue of RDP in Password Safe. Generally, I would not want my admins to RDP to a server using a privileged account, I would want them to RDP to a server using a regular account and then have to elevate privileges with a privileged account once on the server. However, unless I manage my admins regular accounts as well as their privileged accounts in PS, I can only link their privileged account to a server, which means that the RDP session they initiate within PS is using the privileged account and violates the principal of least privilege.If you are managing your admins regular accounts in PS, what challenges have you run into with that?Thanks,Rich Courtright

I have noticed that UVM Appliance and BeyondInsight email notifications do not support communicating with SMTP servers that require Strict StartTLS. Upon investigation, it appears that the Email Notification feature is built on the System.Net.Mail (SmtpClient) library, which is legacy and does not support Strict StartTLS. Has anyone encountered this scenario where SMTP communication is restricted to Strict StartTLS in your environment? If so, what solutions or workarounds have you found? Additionally, does BeyondTrust have any plans to migrate to the MailKit SMTP client, which Microsoft recommends as a modern replacement for System.Net.Mail?