BeyondInsight / Password Safe

So, been getting repeated ongoing asks from our Compliance Team, and this is their ask: for a specific Managed Account, produce a report of every user that can access that credential? Anyone ever been able to pull that off? Using Analytics would be fine, just have not been able to find a report like that.

Hi everyone,Can you please help me understand how to create the custom reports for On-Prem Password Safe. I tried the Pivot Grids feature and it is not much helpful. Thanks,

I am getting an invalid credential when launching a web application. I tested the managed account and password is correct but when I inject this using the ps_automate, it comes up with an invalid credential. I have also added the “FixupPassword=1” under the General section since my password contains spaces. Anything I am missing here or should be trying out? 2025/11/04 13:56:52 [TaskSequence1] BEGIN2025/11/04 13:56:52 [Function] execute_task_sequence_webapp (TaskSequence1)2025/11/04 13:56:52 [TaskSequence1] [INI] WaitLoginWindowDelay=02025/11/04 13:56:52 [TaskSequence1] [INI] XPathElement=//*[@id="username"]2025/11/04 13:56:52 [TaskSequence1] [INI] XPathValue=%username%2025/11/04 13:56:52 [TaskSequence1] [INI] XPathAction=2025/11/04 13:56:52 [Function] insert_custom_strings (*MASKED*)2025/11/04 13:56:52 [Custom string] username2025/11/04 13:56:52 [TaskSequence1] END2025/11/04 13:56:54 [TaskSequence2] BEGIN2025

The following articles were published last week. New Knowledge Base Articles: KB0022381 - Scan account on Linux Sytems not finding local accounts KB0022607 - Password Safe session hanging issue. Error - Unexpected client message in state KB0022898 - How to set up a Resource Broker to ignore and not use proxy

Hello,We are using the secret safe api to pull secrets and plug them into our applications. When testing our script in  PowerShell it works, however, in Python, we are seeing a 404 error. Any idea? Our RunAs user is a domain account. TIA!

We setup the System Event Viewer in the WebConsole for reviewing appliance logs centrally.After doing so, we saw the database balloon in size, it appears the purge settings were not operating successfully.Does anyone know how this purge is supposed to work?Is there a daily scheduled action that runs? A scheduled overnight job? Or is the purge expected to continually happen such that only the last X days of data is retained?

Hi team, We have one windows non domain joined server on which functional test is failing  password rotation of managed account is failing We are getting below error when password test is tried Error(64): The specified network name is no longer available. We tried to RDP managed server from Resource Broker using functional account and it is working fine . All relevant ports(3389,445, 135) for the server from resource broker is successful.  We have followed the KB article : KB0020487 and KB0020498 and all the recommended steps are in p

Hi All, The /appliance page is stuck after entering admin credentials and hitting login. Is there any solution to it or troubleshooting steps that can be performed. Problem:/webconsole is working as expected, /appliance fails to load after entering credentials, the webpage is stuck on the login window. Checked below:1. Inspected Browser Network logs2. IIS Logs3. Appliance Gateway Service logs4. Performed IISRESET, didn't work.

Hello, we have a need to create a known managed account ( this is a local account on system) for multiple systems along with password. We do not want to rotate this password and is same across these systems. (This will not be used unless break-glass scenarios and has approvals + alerting configured). I am looking for a way to automatically sync the password.  I am able to create the account on newly onboarded system using managed system smart rule but can’t set the password.For subscriber/sync accounts , I think it requires Auto Password Management enabled .To do it via API , I think I will need to fetch the cred and send it back from an endpoint running the script. We want to avoid this and manage it within PS or the appliance.Is there a way to trigger this via smart rules . The managed system will be created using API and account created using smart rule. 

Does anyone here have experience with this issue with the PasswordSafe service? After updating to BI version 25.1.1, all of a sudden the services were not able to start. I also check the event viewer, and it says there was a missing DLL. as shown in the screenshot: 

The following articles were published last week. New Knowledge Base Articles: KB0021671 - Report Subscriptions are failing after upgrading to BeyondInsight version 24.2.1 KB0021761 - Last Login date does not reflect correct date or time after scan KB0021818 - Users are unable to see the database list in the application tab after upgrading to Password Safe 23.2 or hig

Hello Is it possible to disable the personal folder in secret safe? can btadmin see the secrets in personal folder? If a user stores in personal folder , and the user leaves organization, we still need to be able to fetch the secrets saved by the user for the enterprise applications. So can we not show personal folders and only show the safes we create for the users?

Hi everyone,We’re currently working on implementing BeyondTrust Password Safe Cloud in a multi-tiered architecture and are looking for detailed documentation or a white paper that outlines recommended setup for Data Center (DC), Disaster Recovery (DR), and UAT environments.If anyone has access to or has previously received the official BeyondTrust Password Safe Cloud architecture white paper ?Appreciate any pointers from the community 🙏

We have an attribute “employeenumber” from on-premAD which is syncd to Entra. Was trying to use this for my directory attribute match for the privileged access but on the drop-down selection in BeyondInsight, it only shows “employeenumber” as the attribute name but the actual Entra attribute name is supposed to be “extensionattribute_<appreg_clientID>employeenumber”. Is there a way to map this to an on-premAD “employeenumber” attribute but use Entra for my requester group? I am just not sure if it PS will recognize it since it s trying to map the requester (from Entra SAML SSO) against the  on-prem AD attribute.

Hi Everyone , For our Password Safe cloud instance,  We have created the Mainframe system and onboarded the accounts on it . On this account under password safe, we have enabled check password and enabled “reset password on mismatch” option.However when the password of account is changed outside of Password Safe i. e directly on Mainframe system, at that time , even though reset password on mismatch is enabled on account under password safe, doesn’t trigger the password change option and hence password remain mismatched unless Admin reset is manually .My requirement , If password of account managed in password safe, gets changed outside of BT, then password should get reset under BT as well. At any given point , BT should have the correct password .Can anyone please let me know how to achieve this? With current setup I have done , what’s the thing I am missing ? Thanks in Advance. Regards,Imran

You can enable in Authentication Option that all new users are enabled with TOTP. but those accounts that are already synced, they are not affected by that setting, is there a smart way to do this then to open up 200 account and enable TOTP on each of them?

We have a requirement to onboard Cisco devices into Password Safe. For privilege escalation, we need to use the 'enable' secret. The non-privileged user account and the enable secret use separate passwords.Is there a way to manage this scenario in Password Safe?

trying to scan SQL server databases getting all the databases but no local accounts any help will be greatly appreciated

Hello everyone,We have encountered a challenging requirement during our discovery scans for a range of IP addresses. In the scan results, some assets appear with their asset names as IP addresses instead of hostnames.We need to filter out these assets and prevent them from being added to Password Safe. Does anyone know how we can filter out assets without hostnames that are still being added to Password Safe? Thank you,Prasad

The following articles were published last week. New Knowledge Base Articles: KB0021339 - Unable to SSH receive error: "An error occured while trying to start the session" KB0021621 - Is it possible to integrate both Privileged Remote Access and Remote Support into one Password Safe environment? KB0022570 - Some group memberships are missing from SAML claim

Hi All,We are facing one problem for DR activity .We are having one Resource Zone say Zone1 which as 2 RBS. During DR activity both RBs are set to be shutdown for few hours . We have another Resource Zone Say Zone 2 which has 2 RBS. My question is , is it possible that when RBs of ZOne 1 are unhealthy , Server access should be attempted from RB2 in Zone2? We have already verified and managed system’s port are open from RBs in Zone 2. I know one approach would be rescan the asset and select RB from Zone 2 but it will take lot of manual effort hence want to keep this option as fall back. If anyone is aware of any other approach , please let me know .Thanks in Advance.Regards,Imran

Hello, we typically have multiple new SDA switches created on regular basis. They have IP address and a hostname when provisioned but will not be added to a DNS server yet. Admins need access to these devices for configuration before they are available in DNS.  What is the best way to add these devices.For existing switches which are in DNS , we add the hostname to Address Group and run IP Scan. The same address group is referenced in Managed Account smart rule. Q1. Add IP address to Address Group via API and trigger a scan . I think this will only add the system = IP address.Q2. when the Address Group is scanned next , PS will know the hostname of it but will it update the same managed system with system = hostname (and IP = IP) ? or it will create two separate managed systems/assets.Even if the system name gets updated with hostname , the managed account smart rule will not apply as it references the Address Group which does not have hostname of the syste

Hi All, I am trying to explore options for bringing in 1500+ AD objects from AD domain without using AD group option (I agree which is best and most suitable option). Kindly help to share if there are any other options to achieve this apart from using AD group.   

Hey everyone, we’re running into a strange issue with the Remmina RDP client and BeyondTrust Password Safe on Linux, and I’m wondering if anyone else has seen this or found a workaround. What’s happening When users download one-time RDP connection files from Password Safe and open them with Remmina, the connection doesn’t go through automatically.Instead, Remmina asks users to re-enter their Password Safe credentials (the same ones they already used to log in to PWS) before the RDP session actually starts. What we’d expectIdeally, the RDP session should just launch automatically, using the credentials passed from Password Safe — no extra prompt.Environment RDP Client: Remmina 1.4.41 (latest) BeyondTrust Product