BeyondInsight / Password Safe

I’ve noticed lately that our system event viewer in is filled with warnings.  Most of them are complete gibberish to me.  Most are like this but with different IDs: CPP: Postpone CQ item due to active Release Request Id:(3753), Expiration time: 5/29/2025 10:33:17 PM UTC - ChangeQueue: id=18576, MAid=663, FAid=, MSid=5, SubDt=2025-05-29 13:33:07 UTC, ChgDt=2025-05-29 13:33:07 UTC, Reason=R, ProcStartDt= UTC, NumFail=, RelID=, ReqID=3751, RemoteCl=false, OWA= These come in sometimes multiple times a minute.  Just for the last 15 minutes, there are 130 of these. There are over 5000 in the past 24 hours.  What is this trying to tell me?

If a shared functional account is used to log into the application server (RDS), users can see files downloaded by others in the Downloads folder from previous sessions. Is there a way to prevent this behavior?

Hello All,We have an existing setup of Beyond Trust u-Series appliances. When we try to access the U-Series appliance portal page, the page is visible requiring username and password. Unfortunately, we have lost the credentials. Is there anyway by which I can get the lost admin credentials back. Please suggest.Thanks,Prasad

Hello TeamThe application session launched via the RDS server allows users to access files placed in the RDS server desktop etc, if we launch the web browser and do ctrl + o . and then navigate.We can also launch cmd and powershell etc. What are recommended hardening for applying segregated access within the application sessions launched via the RDS server as its one single user profile being used for the RDS sessions.

The following articles were published last week. New Knowledge Base Articles: KB0022151 - Is SQL always on required for Active Active environments? KB0022305 - BTUpdater service keeps crashing after update to 3.4.2.1876 KB0022381 - Scan account on Linux Sytems not finding local accounts

Hi,I am new to BeyondTrust.Can I find some Smart Rule examples with explanation?Thanks.

Investigating a requirement to map std user accounts in Password Safe to a dedicated local account (unix in this case) BUT with the same name/format. Unix accounts do NOT have any prefix/suffix additional to their Entra/AD login to PWS account.As a Unix local account, cannot use any account attribute mapping either.The onboarding Smart Rules is ok - we can utilise the regex capability (x characters, y numerics format).It’s the mapping Smart Rule were we have the issue, as this doesn’t provide regex option, mainly suffix/prefix.Any thoughts people?

Hi, We need to onboard GCP IAP application in Password Safe.Would appreciate any help/guidance on automating the login process.Thanks 

Hi All, We expect to close our on premises DC’s in the coming years, and we currently run a traditional RDS farm with F5’s in front to enable the non-SSH/RDP workloads managed by PasswordSafe Cloud…Microsoft RDS licensing options in AWS (AWS is the only answer for us - please don’t suggest Azure!) are very limited and the equivalent would be significantly more costly than the current level. For other internal systems, we’re looking at AppStream2 - has anyone looked at this or other options for PasswordSafe Cloud or are we locked to RDS and the associated costs?Trying to gauge what the community is doing and what experience, if any, is out there 😀 Many thanks in advanceTim

Hello Beekeepers  , I am working on one integration project where i need to give access to password of managed account to users, We will be using disable at rest future to make it true on demand / JIT .  Problem comes in sync, if we leave all default replication to cloud and local it takes about an hour time. i am just wondering does beyond trust has any integration point which can be force ad replication or in cloud ad replication when such a password extracted. 

When API endpoints are changed, how often will this be? With the last big update BI had, some endpoints were depracated. I am curious how often this is going to happen? APIs have become very popular in our environment and alot of our scripts are breaking with these changes. Ex.) In BeyondInsight/Password Safe 24.3, "UserGroupId" has been deprecated.I know the word “Safe” was also replaced with “Folder”. 

How to ensure that even Admin session should be recorded. There should not be an option to avoid Recording.

Dear Team,I am currently configuring Oracle Internet Directories (OID) to integrate Oracle database systems with Password Safe.The provided BT documentation outlines the steps to configure an OID and add Oracle databases as Managed Systems in Password Safe. However, the documentation does not explain how accounts are discovered automatically if we do not perform a scan.https://docs.beyondtrust.com/bips/docs/ps-add-dbSteps Followed:Navigated to Configuration > Privileged Access Management > Oracle Internet Directories.Clicked on "Create New Oracle Internet Directory +".Entered the name, description, and LDAP server information. Checked "Use SSL" as desired.Turned off "Use Anonymous" and entered the name and password.Clicked "Create Directory" and tested the server connection.Issue: The documentation does not provide information on how accounts are automatically discovered without performing a scan. I need g

Hi all,Hoping to confirm how these two values in Password Safe global policy (“Minimum (days) retention for old password” and “Number of old passwords to retain”) operate when one value has been reached but not the other.Eg, if "Number of old passwords to retain" is set to 5 and minimum retention in days is set to 30:-Observation and some doco suggests that if a password is only changed once a month, password history will be kept for 150 days (despite the 30 day retention period) - assumedly delaying purging to allow the minimum of 5 old passwords to be retained.Does this apply in the reverse? Ie, with the same settings, if a password is changed daily, will Password Safe retain 30 old passwords so as to satisfy the 30 day minimum retention?Can anyone confirm?Thanks!

The following articles were published last week. New Knowledge Base Articles: KB0021884 - BeyondInsight Password Safe Licensing FAQs KB0022279 - On the Password Safe dashboard slowest Smart Rules are not shown KB0022327 - How long are session recordings saved for in Password Safe Cloud? Is it configurable?

I have a use case where we use Okta as our SSO, I need to login to https://portal.azure.com and when we enter our domain id it redirects to okta for credentials we enter our credentials and authenticate. now if we need to do this with PS_Automate how can we acheive, I have tried with the ini it takes me to okta page but in that page username field it does not type the details, it stays blank. how can I do this ?

Hi community,we have in our environment for each Windows Server a separated workgroup in active directory.I’ve seen there is no convenient way with SMART Rules to onboard the System as a Managed System with Linked Account and to make it available for each Workgroup. So I’m now thinking about to onboard the system via API Calls. What REST Calls are necessary to onboard the Windows Systems like in the documentation of the API DocDoes somebody has some experiences to onboard like this way? And How can I put the the rights to the User groups over API to Quick Rules? An example in PowerShell would be really great, but other script are also welcome.  RegardsArno

 Howdy!Error when onboarding an user account and force change the password:##################Get user principal using SID:Password change failed. Error: Value cannot be null. (Parameter 'identityValue')Password change failed##################Tried multiple times, but it seems that some value is impeading the force rotation. Any ideas? Kind regards.

With Password Safe 24.3, it was mentioned to me in a call that we are able to still get access as enterprise admins to all passwords. I can’t find the instructions on how to do that. Can anyone point me in the right direction?

I’m looking for a best practices and BeyondTrust recommendations for Secrets Safe. Following is a question asked by one of my customers.  Any thoughts, please feel free to advise. Do you have a “best practice” recommendation on setting up team folders within Secrets Safe?  With our current solution it was recommended that those types of permissions only be granted via local groups to prevent possible escalation of privileges since local group membership would be managed by Password Safe admins, where Directory groups from Azure or AD could be managed by persons who shouldn’t necessarily have rights to manage such access.

Hi ,  Is there a way to rotate password in password safe  based on certain systems or application access. i have bunch of users who access some sensitive app access and some general infra, if user access those sensitive system password rotate more frequently than other systems. Regards,Maulik

Hi, Is there a way to create Discovery Scan Account  over the API like Functional Account in Password Safe ? RegardsArno

The following articles were published last week. New Knowledge Base Articles: KB0022293 - Unable to edit secret in Secret Safe created by a user who does not have permissions anymore KB0022305 - BTUpdater service keeps crashing after update to 3.4.2.1876 KB0022308 - What causes a High Availability active passive appliance to failover?

The following articles were published last week. New Knowledge Base Articles: KB0022248 - What are the deployment requirements for Enhanced Session Auditing (ESA)? KB0022263 - Linux server scan executes init.d scripts instead of validating service existence during status check KB0022277 - How long do discovery support logs reside on the server before being purged?

Hello Team,  We have observed a issue with PasswordSafe, where Managed Account Next change date is calculated based on Last scheduled change date. If the user changes the password manually, Next change date is not updated to new date based on Password change Frequency (Xdays). The problem observed today, is that teams who have manually changed the password for a Service account ahead of a policy based 90-day rotation, as part of a RFC change window, will suddenly have the service account password rotated automatically again (potentially just a few days later) on the 90-day rotation enforcement date by PasswordSafe - thus breaking their production service. How can we achieve this use case in such a way that Next change date is updated based on last change date (scheduled & manual)?