BeyondInsight / Password Safe

I’m starting to onboard users and computers to password safe and I want to allocate certain users to certain servers.So to illustrate.Team A has 5 users each user has a std AD account and a dedicated admin AD account.This team is responsible for several servers which I have put in an AD group. I can do the directory queries and onboard the servers and manage them. I can also onboard and manage the dedicated admin accounts and link them to the std accounts.I’ve hit a road block linking the accounts to the servers.There is an existing onboarding rule which sets an attribute (Tier1Server) on Servers and a rule which sets an attribute (Tier1account) on T1 accounts. The servers I want to sort now and the team users are a subset of Tier 1 so I should be able to use the similar process using attributes.So I create a managed account smart rule with selection criteria of the directory query relating to that user group so I can set an at

Hello all, We are experiencing a behavior with RDP sessions via Password Safe initiated from machines with Windows 11.The session has a slow image loading, appearing to load in rows of images and in blocks.A simple movement of windows within the RDP session causes the image loading of this movement to be very slow.This does not occur if the RDP session is direct with the destination server.But if the connection is through Password Safe being Windows 11 > Resource Broker > Destination server, this slowness is noticed. Has anyone else noticed this problem in your environments? Additionally, this behavior does not occur in Windows 10.Points that I have already checked:- The software installed on the computers are the same between Windows 10 and 11;- The network settings are the same. This behavior occurs on both wireless and wired networks;- The GPOs of the Windows 10/11 stations, Resource

Can BeyondTrust Password Safe support strict logical segregation between two departments (Network Division and IT Security Division) within the same Password Safe deployment, ensuring no visibility of assets, accounts, users, or sessions across divisions? Component Network Division IT Security Division PAM Admin Network PAM Admin Security PAM Admin Assets Network devices Security infrastructure Accounts Network privileged accounts Security privileged accounts Users Network engineers Security engineers Policies Network-specific Security-specific Reports Network only Security only Configuration Network Only Security O

The following articles were published last week. New Knowledge Base Articles: KB0021985 - TOTP setting "Enable for new directory accounts" or "Enable for new local accounts" disabled unexpectedly KB0021993 - How to sync Microsoft Entra ID groups on a schedule - How to turn off group sync schedule per group KB0021996 - Discovery scanner not working - "Event 3: WebHost

Hi ! Just wanted to understand how you are handling the initial API keys /OAuth secret required to authenticate to BI PS itself.e.g. we have BI-managed service account used by few Linux endpoints . This service account is used to map a network drive. We want to fetch the latest credentials via a script from BI PS at user log on and map the network drive. To secure the api key , we are planning to put it on a network share where a Group of users will have access. But this means if the machine is compromised or the internal user wants to get the access , they can fetch the key and service account credentials. We are thinking of rotating this key in BI PS config + network share from a secure server , but this introduces another high privileged account with config access to API + possibly one more account with network share access (Though in a more secured environment). This increases complexity but the key/password is still has same level of security (when compa

How do you manage Microsoft Edge browser updates on RDS servers used for web applications?Do we need to allow continuous internet access for Edge updates and WebDriver checks, or do you manage updates in a controlled/whitelisted manner?  What are the best practices to follow ?

I’d like to understand the recommended approach for onboarding local Linux dedicated accounts. Additionally, from a Linux server perspective, is there a recommended method to configure these accounts so that sudo does not prompt for a password? Thank you.

What is the recommended approach for securely managing and remotely accessing macOS systems using a password safe? Specifically, does a managed application for a VNC client support this use case, and is there an implementation guide? Thank you.

The following articles were published last week. New Knowledge Base Articles: KB0021853 - Deploying a SQL free or SQL-less U-Series appliance shows duplicate names for Session Agent and password changes not occurring KB0022527 - AWS marketplace U-Series appliance configuration wizard failing with error "Page Cannot be Displayed" KB0022767 - "Error 1722 there is a prob

Hello everyone,I am currently encountering an issue when performing a managed account password change on F5 BIG-IP. I would like to describe the issue as follows:On the F5 BIG-IP device, I created a user named "btfunctional" and configured this user in PAM as a Functional Account (FA). I performed a Test Functional Account, and it completed successfully. However, when I attempt to change the password of another managed account, I encounter the following error:[btfunctional@ltm01:Active:Disconnected] ~ # Thread was interrupted from a waiting state. Password change failed.I would greatly appreciate your support and assistance with this issue.Thank you very much.

Hello everyone,We have encountered a challenging requirement during our discovery scans for a range of IP addresses. In the scan results, some assets appear with their asset names as IP addresses instead of hostnames.We need to filter out these assets and prevent them from being added to Password Safe. Does anyone know how we can filter out assets without hostnames that are still being added to Password Safe? Thank you,Prasad

Hello Team, We have one requirement for deletion of 1000+ managed systems without any Managed account.Is there any easy way to delete them in bulk? Can someone help with API script or DB Query to do so. Thanks,Prasad

Hello! Is there any news or a roadmap regarding the implementation of Direct Connect within the Pathfinder portal? This feature would significantly reduce connection time and greatly improve productivity.Unfortunately, I don’t have access to the Ideas Portal to open a request about this, but if anyone knows anything, I would be very grateful.Thanks!

Hi Team, is there any way to clean/flush the password  stored in clipboard “when you do a copy of credentials from password safe , it does not get cleared automatically from your clipboard. The clipboard storers the credentials rather than clearing the clipboard after a short period of time”

The following articles were published last week. New Knowledge Base Articles: KB0021206 - Appliance self-signed certificate does not have Subject Alternate Name KB0021697 - Registering FIDO2 authenticator fails - Could not create credentials KB0021739 - Resource Broker SAML error - GetGroupForADUser for domain cred failed

Hi,Anyone else have a need to keep password history for more than one year? A problem we face is if we need to restore a windows server from more than a year ago, we won’t be able to log in via the local administrator password as it will be unknown. I know there are some workarounds where you can reset if it is an AzureVM, but having history more than a year is needed.Anyone have any smart ways to work around this limitation?Someone has already logged an idea for this if you want to vote.Allow Password History For More Than 360 | All Product Ideas - PublicThanks

Hi Team,I am looking for creating the script to automate Application onboarding in Beyondtrust Password Safe. We are using Cloud version of Password Safe.  I am exploring BT API However I dont see any API to create application in BT. I only see API to get application or to remove application or assign application to Manage account . From this List , I dont see any api to create application into BT. Requesting help here to guide how application can be created in BT using API.Regards,Imran Aliyani

hi guys, is there a way to get a list of AD managed systems without linked accounts? thank you

The following articles were published last week. New Knowledge Base Articles: KB0022504 - Clicking update connector or create connector with the type SNMP results in an error: "Form is stale" KB0022561 - Service Account Usage Report showing duplicate service accounts - Service Account Usage Report missing managed service accounts KB0022739 - Functional Account test f

Hi All,I'm new to PS but have been running RS for over a year now, we export syslog via webhooks on RS and PRA to our Rapid7 SIEM and it is working well, but I cannot seem to get it to work with PS. Any ideas?

I have strange behavior in my PasswordSafe.I am using an application session, and when I try to start an RDP Session / Start Application Session: When using the option to run on a different system with the functional account, it works perfectly. When using the option to run on the current system with the user account, the RDP session does not start. It shows a black screen for some time and then closes. When I checked the logs in the second case, I found the following: INFO: Accepted RDP session 1234 for 1.2.3.4:1234 INFO: RDP Handler 1234 starting INFO: Found RDP certificate: My:.... INFO: Reading self signed cert INFO: (RDP server) Client Security: NLA:1 TLS:1 RDP:0 INFO: (RDP server) Negotiated Security: NLA:0 TLS:1 RDP:0 INFO: (RDP server) Server Security: NLA:0 TLS:1 RDP:0 ERROR: (RDP server) BIO_read returned a system error 0: No error ERROR: (RDP server) transport_read_layer:freerdp_set_last_error

I can see several old sessions still appearing in the Active Sessions list in Password Safe, even though only today’s sessions should be showing. 

Hi everyone, have any of you implemented High Availability using a proxy server, or worked with customers who have deployed this setup? If so, I’d appreciate hearing about your experience, challenges, and overall results.Please share any relatable articles, would appreciate it. Thanks! 

The following articles were published last week. New Knowledge Base Articles: KB0021856 - After upgrading to 24.3 or higher, Create New Safe button is missing KB0023132 - Resource Broker fails to update with error - [Providers.IdentityServerSettingsProvider.RegenerateToken] Failed to regenerate token. KB0023134 - Where are the files for the Workforce Password Group Po

Hi,I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging.I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This wou