Skip to main content

BeyondInsight / Password Safe

Manage privileged passwords, accounts, keys, secrets, and sessions for people and machines and secure non-privileged employee passwords for business applications.

208 Topics
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
published in General
Monthly Buzz - April - Password Safe

Discover What's New in Password Safe 24.3: Enhanced Cloud Support and Security Features As organizations continue to adopt and migrate to cloud, ensuring management of all identities has become more complex than ever before. Addressing secrets sprawl and access management across the entire estate to achieve compliance and maintain security is complicated and requires visibility into more areas than many organizations have bandwidth to achieve. Further, DevOps teams are being tasked with deploying as quickly as possible and are often needing access to the same credentials across teams, while also ensuring least privilege access and operational efficiency is maintained.Read the full blog post here. Latest Available Version: Password Safe 24.3– December 2024 Beekeepers Hot Topics Export Accounts from BeyondInsight“We have one environment of BeyondTrust Insight with scanned accounts and managed accounts. We are planning to setup backup environment at different location with different domai

320
B
Community Manager
M
maulik shahApprentice
asked in General
password rotation

Hi ,  Is there a way to rotate password in password safe  based on certain systems or application access. i have bunch of users who access some sensitive app access and some general infra, if user access those sensitive system password rotate more frequently than other systems. Regards,Maulik

51
MikeK
vikas5611
vikas5611Newcomer
asked in General
How to Onboard Oracle internet directory in Password Safe

Dear Team,I am currently configuring Oracle Internet Directories (OID) to integrate Oracle database systems with Password Safe.The provided BT documentation outlines the steps to configure an OID and add Oracle databases as Managed Systems in Password Safe. However, the documentation does not explain how accounts are discovered automatically if we do not perform a scan.https://docs.beyondtrust.com/bips/docs/ps-add-dbSteps Followed:Navigated to Configuration > Privileged Access Management > Oracle Internet Directories.Clicked on "Create New Oracle Internet Directory +".Entered the name, description, and LDAP server information. Checked "Use SSL" as desired.Turned off "Use Anonymous" and entered the name and password.Clicked "Create Directory" and tested the server connection.Issue: The documentation does not provide information on how accounts are automatically discovered without performing a scan. I need guidance on how to ensure that accounts are discovered and managed correctly

50
vikas5611
M
maulik shahApprentice
asked in General
Disabled at Rest works and cloud access

Hello Beekeepers  , I am working on one integration project where i need to give access to password of managed account to users, We will be using disable at rest future to make it true on demand / JIT .  Problem comes in sync, if we leave all default replication to cloud and local it takes about an hour time. i am just wondering does beyond trust has any integration point which can be force ad replication or in cloud ad replication when such a password extracted. 

30
M
R
ravi.bisramNewcomer
asked in General
Best Practice for Secret Safe.

I’m looking for a best practices and BeyondTrust recommendations for Secrets Safe. Following is a question asked by one of my customers.  Any thoughts, please feel free to advise. Do you have a “best practice” recommendation on setting up team folders within Secrets Safe?  With our current solution it was recommended that those types of permissions only be granted via local groups to prevent possible escalation of privileges since local group membership would be managed by Password Safe admins, where Directory groups from Azure or AD could be managed by persons who shouldn’t necessarily have rights to manage such access.

361
tclowater
BeyondTrust Employee
J
Julia0881Apprentice
asked in General
Administrative access to all vaults in Secret Safe

With Password Safe 24.3, it was mentioned to me in a call that we are able to still get access as enterprise admins to all passwords. I can’t find the instructions on how to do that. Can anyone point me in the right direction?

294
MikeK
A
ArnoApprentice
asked in General
Discovery Scan Account via API ?

Hi, Is there a way to create Discovery Scan Account  over the API like Functional Account in Password Safe ? RegardsArno

411
H
BeyondTrust Employee
K
kimberlyvApprentice
asked in General
Secret Safe API 404 Error when using Python script

Hello,We are using the secret safe api to pull secrets and plug them into our applications. When testing our script in  PowerShell it works, however, in Python, we are seeing a 404 error. Any idea? Our RunAs user is a domain account. TIA!

243
C
BeyondTrust Employee
H
HisysApprentice
asked in General
PS_Automate Portal Azure access using Okta sso

I have a use case where we use Okta as our SSO, I need to login to https://portal.azure.com and when we enter our domain id it redirects to okta for credentials we enter our credentials and authenticate. now if we need to do this with PS_Automate how can we acheive, I have tried with the ini it takes me to okta page but in that page username field it does not type the details, it stays blank. how can I do this ?

40
H
A
ArnoApprentice
asked in General
Quick Rules in PWS

Hi community,we have in our environment for each Windows Server a separated workgroup in active directory.I’ve seen there is no convenient way with SMART Rules to onboard the System as a Managed System with Linked Account and to make it available for each Workgroup. So I’m now thinking about to onboard the system via API Calls. What REST Calls are necessary to onboard the Windows Systems like in the documentation of the API DocDoes somebody has some experiences to onboard like this way? And How can I put the the rights to the User groups over API to Quick Rules? An example in PowerShell would be really great, but other script are also welcome.  RegardsArno

60
A
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (May 5 - May 12)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022293 - Unable to edit secret in Secret Safe created by a user who does not have permissions anymore KB0022305 - BTUpdater service keeps crashing after update to 3.4.2.1876 KB0022308 - What causes a High Availability active passive appliance to failover?

100
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 28 - May 5)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022248 - What are the deployment requirements for Enhanced Session Auditing (ESA)? KB0022263 - Linux server scan executes init.d scripts instead of validating service existence during status check KB0022277 - How long do discovery support logs reside on the server before being purged? KB0022279 - On the Password Safe dashboard Slowest Smart Rules are not shown KB0022281 - How is the first Radius authentication request defined in Password Safe? KB0022286 - After failed hotfix, error messages received on password rotation and test KB0022308 - What causes a High Availability active passive appliance to failover? KB0022313 - How can the Resource Broker be hardened? KB0022314 - How do Resource Brokers work with round robin? Can one be selected for a specific system? KB0022315 - Can alerts

110
GloriaB
BeyondTrust Employee
S
SammedPatilNewcomer
asked in General
Managed Account Next change date should consider Last change date

Hello Team,  We have observed a issue with PasswordSafe, where Managed Account Next change date is calculated based on Last scheduled change date. If the user changes the password manually, Next change date is not updated to new date based on Password change Frequency (Xdays). The problem observed today, is that teams who have manually changed the password for a Service account ahead of a policy based 90-day rotation, as part of a RFC change window, will suddenly have the service account password rotated automatically again (potentially just a few days later) on the 90-day rotation enforcement date by PasswordSafe - thus breaking their production service. How can we achieve this use case in such a way that Next change date is updated based on last change date (scheduled & manual)?

233
L
K
kimberlyvApprentice
asked in General
API Endpoints

When API endpoints are changed, how often will this be? With the last big update BI had, some endpoints were depracated. I am curious how often this is going to happen? APIs have become very popular in our environment and alot of our scripts are breaking with these changes. Ex.) In BeyondInsight/Password Safe 24.3, "UserGroupId" has been deprecated.I know the word “Safe” was also replaced with “Folder”. 

270
K
B
BartoszApprentice
asked in General
ESA deployment requirements

Hello community,I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one?I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment.Cheers,Bartosz

265
B
frank.colvin
frank.colvinVeteran
asked in General
SSH using Secure CRT, Winscp or sftp clients

we are rolling out linux/unix managed systems and we are having great success with putty, however our developers user Secure CRT, winscp and sftp clients. does anyone have any advice/guidance? 

342
R
B
BartoszApprentice
posted in General
More granular access rights for custom PS Admin roles

Hello everyone,We’re struggling with lack of possibility to introduce more granular access for PS Administrators, there’s an idea for the same More granular access rights for custom PS | All Product Ideas - Public Do you have similar experience with the product? If yes then please share your thoughts on that and like an idea if you find it useful, maybe it will get some attention thanks to that.Cheers,Bartosz 

648
R
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 21 - Apr 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021742 - How to configure Duo as an Identity Provider for SAML KB0022219 - Workforce Passwords continuously spins (loads) and last synchronized shows 'an error occurred' KB0022222 - Group sync fails when selecting a specific Domain Controller in PS cloud KB0022223 - Unable to create Smart Rule - An unknown error occurred KB0022230 - With Host Headers Restriction State (HHRS) configured, accessing an application or remote session results in error: Invalid session token KB0022231 - AD Webconsole logins fail in active active environments following an upgrade "An authentication error occurred" KB0022234 - Okta SAML integration is failing with 500 internal server error KB0022240 - Unable to rename organization "an error occurred while attempting to save this item" KB0022241 - Password Safe tile Accou

100
GloriaB
BeyondTrust Employee
T
BeyondTrust Employee
tkellumBeyondTrust Employee
asked in General
Remote App Launch Display Scaling

I wanted to bring this to the community for feedback as it was brought up for discussion during a troubleshooting case for a Password Safe customer, while configuring Remote Applications to be launched via ps_automate.exeIt was found that if we expand the Remote App window during the login process, we may see the login screen display look distorted based on the size the window takes up on the user’s screen. I attached a screen capture showing what was observed while initiating the session with a single high resolution display detected and one with multiple displays detected. observed remote app loginThe important thing to note here is that this does NOT affect the look of the actual application when it appears in RemoteApp mode and it does not affect the ability to launch the application itself. This is purely a cosmetic concern.I have three questions on this:Is this this due to the configuration of the Remote App session? Is this the result of a limitation of FreeRDP? What would be th

180
T
BeyondTrust Employee
T
TimNewcomer
posted in General
We run RDS farms for PSCloud on premises - what would you use in AWS?

Hi All, We expect to close our on premises DC’s in the coming years, and we currently run a traditional RDS farm with F5’s in front to enable the non-SSH/RDP workloads managed by PasswordSafe Cloud…Microsoft RDS licensing options in AWS (AWS is the only answer for us - please don’t suggest Azure!) are very limited and the equivalent would be significantly more costly than the current level. For other internal systems, we’re looking at AppStream2 - has anyone looked at this or other options for PasswordSafe Cloud or are we locked to RDS and the associated costs?Trying to gauge what the community is doing and what experience, if any, is out there 😀 Many thanks in advanceTim

210
T
R
Robert A.Rising Star
asked in General
Securing default generic accounts (bt/bi/bu-admin)

Hi,I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging.I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This would only cover the

926
R
B
BartoszApprentice
posted in General
Additional TOTP step for federated authentication

Hi all,I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Additional TOTP step for federated | All Product Ideas - Public it’s not possible to use TOTP when federated authentication to Password Safe is enabled.Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful.Cheers,Bartosz 

685
rhagerm
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021352 - Secrets Safe import secrets menu option missing KB0022203 - User in admin group is not able to see "view all safes" toggle in Secrets Safe KB0022204 - Cannot view discovery reports "An error was reported" KB0022217 - Secrets Cache install fails with error "0x80070643 - Fatal error during installation" KB0022218 - End user does not have personal folder in Secrets Safe

90
GloriaB
BeyondTrust Employee
S
suhail.salimNewcomer
asked in General
Change AD user status from active to inactive/disabled

Hi All,We have AD users in password safe who are quarantined and form login disabled. The users are no longer in organizations. The group we created to onboard these users are also disabled/deleted. The access revoke method used by earlier admins were incorrect and they removed the group from password before syncing them. Is there a way we can make these users status as inactive?

302
MikeK
D
Didla DheerajNewcomer
asked in General
Enhance the disco scans so they don't generate the false-positive logon events

Hi All,When the Password Safe Detailed Discovery Scan runs against a Windows server, the BTExecService agent deployed on the scanned server enumerates the members of all local admin groups, so these can eventually be onboarded and managed by Password Safe. We have observed that Group Memberships for each enumerated account are also checked. This enumeration process is causing the LastLogonTimeStamp for the enumerated accounts to be updated, generating logon events attributed to the Discovery Scan agent BTExecExt.Phoenix.exe, even though no actual logon operation took place.In fact, according to the Microsoft article below, the LastLogonTimeStamp attribute can be updated and trigger a logon event even if the user has not logged on. This behaviour is an artifact of a Kerberos operation known as Service-for-User-to-Self (S4u2Self), in which a client/service can request a ticket for a user that is only useful for things like determining Access Checks or Group Membership.https://techcommuni

641
H
BeyondTrust Employee

Badge Earners

  • BCA: Endpoint Privilege Management - Windows
    jchewhas earned the badge BCA: Endpoint Privilege Management - Windows
  • BCIE: Password Safe
    ravi.bisramhas earned the badge BCIE: Password Safe
  • BCIE: Privileged Remote Access
    ravi.bisramhas earned the badge BCIE: Privileged Remote Access
  • BCA: Endpoint Privilege Management - Windows
    omarmohy98has earned the badge BCA: Endpoint Privilege Management - Windows
  • BCIE: Password Safe
    Emre Yardimcihas earned the badge BCIE: Password Safe
Show all badges
Terms & ConditionsCookie settings