BeyondInsight / Password Safe

We have an attribute “employeenumber” from on-premAD which is syncd to Entra. Was trying to use this for my directory attribute match for the privileged access but on the drop-down selection in BeyondInsight, it only shows “employeenumber” as the attribute name but the actual Entra attribute name is supposed to be “extensionattribute_<appreg_clientID>employeenumber”. Is there a way to map this to an on-premAD “employeenumber” attribute but use Entra for my requester group? I am just not sure if it PS will recognize it since it s trying to map the requester (from Entra SAML SSO) against the  on-prem AD attribute.

Hi Everyone , For our Password Safe cloud instance,  We have created the Mainframe system and onboarded the accounts on it . On this account under password safe, we have enabled check password and enabled “reset password on mismatch” option.However when the password of account is changed outside of Password Safe i. e directly on Mainframe system, at that time , even though reset password on mismatch is enabled on account under password safe, doesn’t trigger the password change option and hence password remain mismatched unless Admin reset is manually .My requirement , If password of account managed in password safe, gets changed outside of BT, then password should get reset under BT as well. At any given point , BT should have the correct password .Can anyone please let me know how to achieve this? With current setup I have done , what’s the thing I am missing ? Thanks in Advance. Regards,Imran

You can enable in Authentication Option that all new users are enabled with TOTP. but those accounts that are already synced, they are not affected by that setting, is there a smart way to do this then to open up 200 account and enable TOTP on each of them?

We have a requirement to onboard Cisco devices into Password Safe. For privilege escalation, we need to use the 'enable' secret. The non-privileged user account and the enable secret use separate passwords.Is there a way to manage this scenario in Password Safe?

trying to scan SQL server databases getting all the databases but no local accounts any help will be greatly appreciated

The following articles were published last week. New Knowledge Base Articles: KB0021339 - Unable to SSH receive error: "An error occured while trying to start the session" KB0021621 - Is it possible to integrate both Privileged Remote Access and Remote Support into one Password Safe environment? KB0022570 - Some group memberships are missing from SAML claim

Hi All,We are facing one problem for DR activity .We are having one Resource Zone say Zone1 which as 2 RBS. During DR activity both RBs are set to be shutdown for few hours . We have another Resource Zone Say Zone 2 which has 2 RBS. My question is , is it possible that when RBs of ZOne 1 are unhealthy , Server access should be attempted from RB2 in Zone2? We have already verified and managed system’s port are open from RBs in Zone 2. I know one approach would be rescan the asset and select RB from Zone 2 but it will take lot of manual effort hence want to keep this option as fall back. If anyone is aware of any other approach , please let me know .Thanks in Advance.Regards,Imran

Hello, we typically have multiple new SDA switches created on regular basis. They have IP address and a hostname when provisioned but will not be added to a DNS server yet. Admins need access to these devices for configuration before they are available in DNS.  What is the best way to add these devices.For existing switches which are in DNS , we add the hostname to Address Group and run IP Scan. The same address group is referenced in Managed Account smart rule. Q1. Add IP address to Address Group via API and trigger a scan . I think this will only add the system = IP address.Q2. when the Address Group is scanned next , PS will know the hostname of it but will it update the same managed system with system = hostname (and IP = IP) ? or it will create two separate managed systems/assets.Even if the system name gets updated with hostname , the managed account smart rule will not apply as it references the Address Group which does not have hostname of the syste

Hi All, I am trying to explore options for bringing in 1500+ AD objects from AD domain without using AD group option (I agree which is best and most suitable option). Kindly help to share if there are any other options to achieve this apart from using AD group.   

Hey everyone, we’re running into a strange issue with the Remmina RDP client and BeyondTrust Password Safe on Linux, and I’m wondering if anyone else has seen this or found a workaround. What’s happening When users download one-time RDP connection files from Password Safe and open them with Remmina, the connection doesn’t go through automatically.Instead, Remmina asks users to re-enter their Password Safe credentials (the same ones they already used to log in to PWS) before the RDP session actually starts. What we’d expectIdeally, the RDP session should just launch automatically, using the credentials passed from Password Safe — no extra prompt.Environment RDP Client: Remmina 1.4.41 (latest) BeyondTrust Product

The following articles were published last week. New Knowledge Base Articles: KB0021400 - Password Safe Activity Report, the Smart Group parameter shows error: This list contains no data KB0021656 - Users with delegated access to Analytics and Reporting cannot download subscription reports KB0021738 - Testing MS SQL system Functional Accounts fails error: The target p

What level of customization is available in Password Safe Cloud?The customer is specifically interested in customizing elements such as banners, logos, admin messages, and approval email templates

Hi All, We have migrated from one Password Safe appliance to another, as part of the migration, we moved the sessionmonitoring folder to the new appliance, with all the recordings. Database is migrated successfully; I can see all the Completed Sessions on the portal. When I try to view any session recording which is migrated from old appliance, getting below error: New appliance name is different from old one. Any advice to fix the issue? Thank you.

Hi all,I have onboarded winscp as an application in beyond trust. it is working fine however there is some delay before hostname username and password are injected in respective fields. can anyone please let me know how to resolve this issue. Regards Imran

We have created the Local account on Custom Platform /Linux system mapped it user one-to-one since We cannot mapped it dedicated since user's Admin account and Requestor id is not matching . Below is scenario, 1. User Admin id is PA091922. user's Requestor Id :MSP9192 Since users Requestor id and Admin Id are not matching , we have mapped this using one to one so that user can login to BT and should see this id ->PA09192This mapping is working fine and user is able to see this Id. However problem here is When any user , having Admin access, logs in to BT, they are also able to see  this id -PA09192. Below KB article explains the reason but we dont want Admin to view and access this id https://beyondtrustcorp.service-now.com/csm?id=kb_article_view&sys_k

Hi All,I am currently exploring options to onboard more than 1500+ Active Directory (AD) objects from an AD domain without using AD groups.I have developed a sample PowerShell script that uses the BeyondTrust Password Safe (BeyondInsight) REST API to import AD managed accounts in bulk.Using the POST API endpoint, I am successfully able to create multiple managed accounts under a Windows platform managed system (entry type: Asset). The script works as expected for Windows systems.However, when I try to use the same API for a Managed System of platform type Active Directory (entry type: Domain), the API call fails with an HTTP 400 (Bad Request) error.Could you please confirm if the same POST API endpoint is supported for creating

Hi All,I want to onboard WinSCP as an application in Beyondtrust password safe. If any one has worked on similar task or onboarded WinSCP as application, can you please  help me here?I want to understand how will the .ini file be created for it . I understand hostname, username and password I can pass it through Application configuration from PAM , But unable to understand how can I render those values on application launch.Awaiting reply . thanks in advance. Regards,Imran Aliyani

The following articles were published last week. New Knowledge Base Articles: KB0021528 - Direct connect RDS sessions fail when using 2016 RDS servers with TLS 1.0 disabled KB0021684 - .NET updates missing from Supporting Software or SUPI updates KB0021768 - BeyondTrust Discovery Agent not working - btdiscovery testc returns: Error 401: not authorized

The following articles were published last week. New Knowledge Base Articles: KB0021657 - LDAP directory credentials error: The credentials entered failed to validate - How to create bind credential for LDAP server such as Redhat IDM KB0021660 - Editing an Active Directory user in User Management error - There are one or more invalid fields KB0021678 - Unable to delet

Hi ALL,We have requirement to enable form Login for 2000 users in Password Safe. From BT portal, there is no bulk update option available .I am looking for any API if available then we can use it for bulk update and enable form login. I know alternately we can reach to BT support team and get it done from Backend. However we want to explore first if any API is available to achieve this.Can anyone please let me know if any REST API available that I can use and update the user profile .Awaiting for response. thanks in Advance.  

What are the best practices for configuring managed accounts for non-privileged access?For example, 200 developers who need access to multiple servers.What is the recommended best practice in this scenario?Specifically: Should each developer have an individual non-privileged domain account?Is there a better approach for managing a large number of non-privileged users accessing multiple servers (e.g., using groups, role-based access, PAM, etc.)?Very important: We do not want one developer’s session to be accessible or “stealable” by another developer.Looking for guidance on how organizations typically handle this setup securely and efficiently.

Hey Community, I’m looking for a way to manage service accounts via automation from Password Safe that will update credentials for service accounts that are used on Canon copier models MDF iR-ADV C5860 & MDF iR-ADV C5850. Is there a way to do this? I believe they use a proprietary OS called MEAP and their documentation is not very robust. Thanks!

We have an administrators group for each server in AD. Each member of this group has the local administrator rights for the respective server due to their membership. The servers are all in the same OU in AD. Unfortunately, nothing can be changed to the AD structure in the foreseeable future.We now want to onboard the Windows servers in the PWS. For compliance reasons, we have to work with named accounts on the servers.What is the best way to onboard the approx. 500 servers and the 300 managed linked accounts now?Creating a smart rule for each server, each administrator and then creating a mapping rule is not really a solution, is it?Regard Arno

Why the Whiteboard? Do I have access to PasswordSafe? Can I access the managed account?Why the Whiteboard?PasswordSafe has some ✨ nuance ✨ around authentication that can be a bit different than people are used to. The API tokens, on their own, aren’t permissioned, and accessing via API won’t always show what’s available in the web console. There’s a difference of accessing PasswordSafe and access a managed account. Because of that, I used a whiteboard to show the generic workflow that covers the basics for PasswordSafe access. After sending this to a few peo