Skip to main content

Events
Groups
BeyondTrust University
Support Portal
Ideas Portal (Aha!)
BeyondTrust.com

Why BeeKeepers?

4 months ago

Home
Community
BeyondInsight / Password Safe

BeyondInsight / Password Safe

Manage privileged passwords, accounts, keys, secrets, and sessions for people and machines and secure non-privileged employee passwords for business applications.

93 Topics

GloriaBBeyondTrust Employee

posted in General

BeyondTrust Product Update Server changing from Imperva to CloudFlare

Starting December 18, 2024, the BeyondTrust Product Update Server will change from Imperva cloud protection to CloudFlare cloud protection. To receive updates, you must add the Cloudflare IP addresses to your firewall allow lists. To view the list of IP addresses, refer to https://www.cloudflare.com/ips/. Additionally, if using domain allow listing, the below can be used: *.cdn.cloudflare.net.

rimeda201Apprentice

asked in General

Managed Account via Smart Rule

I'm trying to manage AD accounts via Smart Rule, however, I select Directory Query and then when I select the domain nothing comes back, I've already added the domain in “Domain Management”, what else could it be?

AndrewApprentice

asked in General

Single Sign on Experience via Remote Desktop services when a session started via password safe

I have a windows 2019 server enabled with RDS services and password safe for users that need to have privileged access to cloud apps that are onboarded as enterprise apps in Entra / Azure. How can i give users a single on sign experience when they do not have access to the account password? I am trying to avoid published apps and keep my admin overheads as low as possible.Has any here been able to make this happen? I had something running to support this when we had ADFS, but sadly we have moved on.

SFARising Star

asked in General

RDCMAN tool bulk import connection strings

Anyone has setup RDCMAN tool ( the microsoft remote desktop manager tool) for multiple servers via script or csv? We have 1000 servers to configure, any way to do automate the import or the connection string configurations?

Chitta2019Rising Star

asked in General

Powershell script for password update on managed system

I need a PowerShell script which will set the password on managed system once the managed account password is rotated by functional account as per password policy in PasswordSafe. I think it’s possible through propagation features but don’t know how to do. Can anyone please help me on this?

NectarNinjaApprentice

asked in General

Everything about LDAPs and more...

Hi everyone, hope y’all having a great holiday season so far! We’ve been reading non stop KB0017007 and could not get to work the LDAPs with the rotation of accounts. All of this was detected by a customer that captured the traffic between Password Safe and their AD and saw the credentials when the appliance rotated the passwords. We tried every extention of Certificates (PBX,Cert,etc) and nothing could seem to work, so I come forward asking for some experience from everyone. Best practices say the UVM should not not be added to the AD (due to possbile GPO issues and other), and the customer uses a “*.customer.com” (wildcard) certificate for their whole roster of Servers, dont know how that pans out here. Ports are ok, so far. So, connectivity issues are the least to check for now. What are your experiences when Configuring and Enabling this feature? any tips and tricks or additional information are highly thanked. Kind regards.

udohsNewcomer

asked in General

How to Determine Beyond Insight Appliance uptime

Were do you go to see the Password Safe UVM Appliance/ Beyond Insight total uptime

Prudhvi KeertipatiVeteran

asked in General

Password Safe Cloud - Splunk Cloud - SSL/TLS Error - Failed to Open Connection

Hi Team,As per the below KB article, for SSL/TLS connection error, we need to import Splunk certificate chain to U-Series Appliance and disable the client authentication check on BI Configuration.How to fix SSL/TLS connection for Password Safe Cloud, because we don't have access to backend U-Series Application and BI Configuration? BeyondInsight / Password Safe - Splunk Test Connector error: "Failed to open connection" - Splunk test script

frank.colvinTrailblazer

asked in General

Appliance locking out AD account.

2 of our 5 appliances are locking my AD account. The lockouts of my ad account are coming from these two serversthese appliances are not domain joined.The only time I use my ad account on these servers is:to log into the web UI. to map network drives to move files on and off.This started back in April and wound up turning them off. turned them back on a week and a half ago and deleted the btadmin profile and that seemed to clear up the problem. then earlier this week I had to map a network drive to get files on and off the appliance and it started happening again. when I map the drives I do not save my password nor do I set it to reconnect on login but something on the appliances is locking my account out.we have checked the credential manager and there are no passwords there. we have checked the net use command and there are no persistent mappings. we have searched through the registry and there are no entries tied to my AD account.I tried deleting the profile again but this time it d

Nagapriya JRising Star

asked in General

Import Secrets in Secret Safe

The notes is not getting imported while i am importing the secrets

Charles NewmanApprentice

asked in General

Password Safe (on-prem) Analysis Report

Per release notes for 24.2.1, the BeyondInsight Analysis feature is planned to be removed on the next release. The logic behind removing this feature is that this report is akin to the Windows event logs; it contains a lot of details that can be confusing to lesser experienced PAM administrators. This has led to support cases for BT and I don’t blame them for wanting to depreciate this. However, if you have an on-premise Password Safe environment with more than a few UVM’s, this tool can be very valuable if you want to get a quick glimpse of your entire environment vs. having to go to each UVM/Worker node to gather information.I have created an “Aha!” idea (Analyzer Results (Please Don't Remove | All Product Ideas - Public) asking that this be reconsidered.Does anyone else find this tool useful? If so, check out the idea link above and give it an upvote.

GloriaBBeyondTrust Employee

published in General

BeyondInsight / Password Safe - Knowledge Article Publications (Dec 2 - Dec 9)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021659 - Configuring SAML login with multiple domains in BeyondInsight Password Safe receiving "An error has occurred Oops! Something went wrong! KB0021674 - Unable to change Entra ID Managed Account's password - Error Details shows Index and Length must refer to a location within the string KB0021724 - How to use psrun command KB0021742 - How to configure Duo as an Identity Provider for SAML KB0021745 - Information to collect for SUPI issues when raising a support case KB0021799 - SSH to Paltoalto 7.1 fails with Access denied. Changing password fails: A supplied password or user name is incorrect. Account verification failed KB0021806 - High availability fails after upgrade "Process stopped due to error. The remote server returned an error: (500) Internal Server Error" KB0021811 - Can users be given access

Nicolas.GNewcomer

asked in General

Application session hijacking

Hello everyone, I am having an issue in my enviroment, we have 2 RDS assets who has a load balancer between the PS Server and then. And the session hijacking is occurring only on application session, the access policies is already on the configuration to logoff on disconect, force termination and enhanced session auditing, I tested some ports in the load balancer that are used to deploy the ESA service, 445 and 139, and both were blocked, but even after the release the problem persisted, not all sessions suffer from this problem of session stealing, but it is a significant number that is impacting on the experience of using the tool. Someone can help me with any other alternative to avoid this problem? Thanks

temmytiaNewcomer

asked in General

Linking Smart Rule

This is a suggestion for a smart rule feature. When a linking smart rule (for managed systems) is linked to a directory domain account (managed account), if a managed account is manually removed from the systems assigned to it by the linking smart rule, the systems are added back to the managed account when the linking smart rule processes. Can we have a feature that allows Password Safe to exclude any managed accounts that have been manually removed from the linking rule when it processed?

Varuns29Apprentice

asked in General

Use Case: No Centralised PAM Team

Hey Guys,I have got a use case where my client does not have a centralise PAM team to control end to end asset/accounts onboarding to Password Safe (PS) and manage the BT upgrade. I can think of a solution as BT tool related tasks (patching/upgrading etc.) can be taken by Infra/ IT team and 1 person from each application team (Linux, Windows, Database etc.) can be given permission to perform a set of actions like onboard asset/account, manually trigger update/change password, approve request etc.Application Team owners will be provided with End User Guide explaining each task they can perform so they have all the resources they need.I see there is ISA role which I can leverage for Application Owners but it gives a lot of unwanted permission.Is there any other way where I can create another role in BeyondTrust Password Safe to cater my specifics?Thanks in advance! :)Disclaimer: I have worked in other PAM tools where this was achievable but not sure in BT aspect as I’m new to BT.

AmilaKApprentice

posted in General

RDS CAL Licenses for Application Sessions

Hi Guys,How can we calculate RDS user CAL licenses for below use case for password safe.One PAM user (requestor) is having concurrent 3 applications with one functional account.Do we required 3 RDS CAL licenses or 1 RDS CAL license ?

bt101Trailblazer

posted in General

Use Case: Manual entry of managed account passwords

Hello All,How do you handle use cases where admins need to manually enter the managed account password multiple times in a day. These can be Workstation admins helping end-users directly on end-user workstations and manual entry of passwords is required . As the password rotates very frequently and is complex to remember or type in what is your approach .We have a password manager that they can use on phone , so that they don’t need to carry their laptop or login to PS on end-user machine. We are exploring using Yubikeys or other device which can store partial password and admins can memorize a few characters. Yubikeys don’t allow to restrict storage based on number of characters though,.

tcussatNewcomer

asked in General

Server grouping

Is there a way to limit the servers a user sees when accessing their privileged account? We want to be able to only list servers a user has access to in AD so that they can RDP to them without being overwhelmed with a listing of all servers.

Fabien LandaisRising Star

asked in General

Secret Safe License

Hi,I have a lot of customer who needs Secret Safe + Workforce Password features for all their users to be able to provide a central password storage system. However the licensing model around Secret Safe is crazy because they have to buy a full Password Safe license, just to be able to use Secret Safe module…. and moreover they have to buy a new license just for WFP ! I would like to understand why Secret Safe is not bind as WPF on end user licensing ??? Please provide us more flexibility on this because we are loosing projects :-/

GloriaBBeyondTrust Employee

published in General

BeyondInsight / Password Safe - Knowledge Article Publications (Nov 25 - Dec 2)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021014 - Password Safe Secrets Cache for Linux step-by-step for configuring, testing and troubleshooting KB0021192 - Password Safe Secrets Cache error "Key not valid for use in specified state" KB0021412 - How to manually configure SSH host keys to make fingerprints consistent KB0021752 - Secrets deleted from Secrets Safe are not removed from Secrets cache KB0021768 - BeyondTrust Discovery tool testc returns: Error 401: not authorized KB0021770 - EPM Policy removed from Smart Rule causing error - Failed to load smart rule element KB0021771 - BeyondTrust Discovery tool teste or testc error 403: Forbidden KB0021774 - BeyondTrust Discovery tool teste error 400: BadRequest KB0021782 - BeyondTrust Discovery tool teste testc error 404: Not Found KB0021807 - Qualys scan of Oracle Managed S

AndyHApprentice

asked in General

Updater doesn't show the subscription list

Hello,We have a standalone updater server. It was supposed to download all the subscriptions packages and the 2 UVMs connect to the updater server to get the packages and installed. We actually did the Windows update back on February 2024. However, when we tried to update the appliances to windows security update to 202409, we couldn’t find the subscriptions on the available list. The screenshot was below: The updater server has full Internet access and test connection was success.Below is part of the updaterService log:2024-10-16 11:20:00,152 [15] INFO PackageManager - GetDownloadablePackages()2024-10-16 11:20:00,152 [15] INFO PackageManager - Get subscriptions.2024-10-16 11:20:00,152 [15] INFO A. - GetSubscribedSubscriptions2024-10-16 11:20:00,152 [15] DEBUG PackageDownloadInternal - Service in Online mode using: PackageDownloadInternet2024-10-16 11:20:00,200 [15] INFO A. - GotSubscriptions: Active Directory Bridge2024-10-16 11:20:00,200 [15] INFO A. - GotSubscriptions: Applianc

Abhilash BTNewcomer

asked in General

Concurrent session via Password safe

Hi Beekeepers, Any idea on limit on concurrent session via password safe console maximum limit.

GloriaBBeyondTrust Employee

published in General

BeyondInsight / Password Safe - Knowledge Article Publications (Nov 18 - Nov 25)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021671 - Report Subscriptions are failing after upgrading to BeyondInsight version 24.2.1 KB0021720 - RDP connections in Password Safe fail to Windows Server 2000, 2003, 2008, 2008 R2, 2012, or 2012 R2 systems KB0021727 - How to troubleshoot delays when logging into Password Safe Cloud KB0021738 - Testing MSSQL system Functional Accounts fails error: The target principal name is incorrect KB0021739 - Resource Broker SAML error - GetGroupForADUser for domain cred failed KB0021741 - Can Password Safe rotate Google Workspace Managed Accounts? KB0021748 - Secrets Safe Entitlement Report not showing all secrets "Subreport could not be shown" KB0021781 - Request is auto-approved even though Access Policy is configured with approvers. The Approval Comment states: "Auto-approved because this account does not requi

W1z4rds123Newcomer

asked in General

Allow endusers to watch their own session recordings

Hi, is there a way to allow endusers to watch their own session recordings?I had a developer who wanted to review a 5 hour SSH session he ran to look foir a mistake, however I cant seem to find the function to enable it for him?

GloriaBBeyondTrust Employee

published in General

BeyondInsight / Password Safe - Knowledge Article Publications (Nov 11 - Nov 18)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021620 - Is 24 hours the minimum time a password can be rotated? What options are available for changing password frequency? KB0021654 - Discovery issue for directory query - Error "Selected Smart Rule does not contain any scan targets" KB0021656 - Users with delegated access to Analytics and Reporting cannot download subscription reports KB0021672 - Analytics & Reporting process daily failed - File system error: A string store or binary store with a compatibility level of '1050' is at the maximum file size of 4 gigabytes. KB0021752 - Secrets deleted from Secrets Safe are not removed from Secrets cache KB0021757 - RemoteApps mouse clicks not recorded when using Microsoft Edge browser KB0021761 - Last Login date does not reflect correct date or time after scan

1
2
3
4

Page 2 / 4

Badge Earners

Kragballehas earned the badge BCSE: Privileged Remote Access
kgujashas earned the badge BCA: Password Safe
kgujashas earned the badge BCIE: Password Safe
Vinoth Rajahas earned the badge BCIE: Password Safe
Pablo Salashas earned the badge BCA: Remote Support

Show all badges

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Login with the BeyondTrust Identity Service

Login to the community

Login with the BeyondTrust Identity Service

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK