Skip to main content

BeyondInsight / Password Safe

Manage privileged passwords, accounts, keys, secrets, and sessions for people and machines and secure non-privileged employee passwords for business applications.

175 Topics
V
Varuns29Apprentice
asked in General
Use Case: No Centralised PAM Team

Hey Guys,I have got a use case where my client does not have a centralise PAM team to control end to end asset/accounts onboarding to Password Safe (PS) and manage the BT upgrade. I can think of a solution as BT tool related tasks (patching/upgrading etc.) can be taken by Infra/ IT team and 1 person from each application team (Linux, Windows, Database etc.) can be given permission to perform a set of actions like onboard asset/account, manually trigger update/change password, approve request etc.Application Team owners will be provided with End User Guide explaining each task they can perform so they have all the resources they need.I see there is ISA role which I can leverage for Application Owners but it gives a lot of unwanted permission.Is there any other way where I can create another role in BeyondTrust Password Safe to cater my specifics?Thanks in advance!   :)Disclaimer: I have worked in other PAM tools where this was achievable but not sure in BT aspect as I’m new to BT.

522
GloriaB
BeyondTrust Employee
A
AmilaKRising Star
posted in General
RDS CAL Licenses for Application Sessions

Hi Guys,How can we calculate RDS user CAL licenses for below use case for password safe.One PAM user (requestor) is having concurrent 3 applications with one functional account.Do we required 3 RDS CAL licenses or 1 RDS CAL license ?    

1771
J
BeyondTrust Employee
Fabien Landais
Fabien LandaisRising Star
asked in General
Secret Safe License

Hi,I have a lot of customer who needs Secret Safe + Workforce Password features for all their users to be able to provide a central password storage system. However the licensing model around Secret Safe is crazy because they have to buy a full Password Safe license, just to be able to use Secret Safe module…. and moreover they have to buy a new license just for WFP ! I would like to understand why Secret Safe is not bind as WPF on end user licensing ??? Please provide us more flexibility on this because we are loosing projects :-/

2565
S
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Nov 25 - Dec 2)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021014 - Password Safe Secrets Cache for Linux step-by-step for configuring, testing and troubleshooting KB0021192 - Password Safe Secrets Cache error "Key not valid for use in specified state" KB0021412 - How to manually configure SSH host keys to make fingerprints consistent KB0021752 - Secrets deleted from Secrets Safe are not removed from Secrets cache KB0021768 - BeyondTrust Discovery tool testc returns: Error 401: not authorized KB0021770 - EPM Policy removed from Smart Rule causing error - Failed to load smart rule element KB0021771 - BeyondTrust Discovery tool teste or testc error 403: Forbidden KB0021774 - BeyondTrust Discovery tool teste error 400: BadRequest KB0021782 - BeyondTrust Discovery tool teste testc error 404: Not Found KB0021807 - Qualys scan of Oracle Managed S

360
GloriaB
BeyondTrust Employee
A
AndyHRising Star
asked in General
Updater doesn't show the subscription list

Hello,We have a standalone updater server. It was supposed to download all the subscriptions packages and the 2 UVMs connect to the updater server to get the packages and installed. We actually did the Windows update back on February 2024. However, when we tried to update the appliances to windows security update to 202409, we couldn’t find the subscriptions on the available list. The screenshot was below: The updater server has full Internet access and test connection was success.Below is part of the updaterService log:2024-10-16 11:20:00,152 [15] INFO PackageManager - GetDownloadablePackages()2024-10-16 11:20:00,152 [15] INFO PackageManager - Get subscriptions.2024-10-16 11:20:00,152 [15] INFO A. - GetSubscribedSubscriptions2024-10-16 11:20:00,152 [15] DEBUG PackageDownloadInternal - Service in Online mode using: PackageDownloadInternet2024-10-16 11:20:00,200 [15] INFO A. - GotSubscriptions: Active Directory Bridge2024-10-16 11:20:00,200 [15] INFO A. - GotSubscriptions: Applianc

1424
GloriaB
BeyondTrust Employee
A
Abhilash BTNewcomer
asked in General
Concurrent session via Password safe

Hi Beekeepers, Any idea on limit on concurrent session via password safe console maximum limit.

2981
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Nov 18 - Nov 25)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021671 - Report Subscriptions are failing after upgrading to BeyondInsight version 24.2.1 KB0021720 - RDP connections in Password Safe fail to Windows Server 2000, 2003, 2008, 2008 R2, 2012, or 2012 R2 systems KB0021727 - How to troubleshoot delays when logging into Password Safe Cloud KB0021738 - Testing MSSQL system Functional Accounts fails error: The target principal name is incorrect KB0021739 - Resource Broker SAML error - GetGroupForADUser for domain cred failed KB0021741 - Can Password Safe rotate Google Workspace Managed Accounts? KB0021748 - Secrets Safe Entitlement Report not showing all secrets "Subreport could not be shown" KB0021781 - Request is auto-approved even though Access Policy is configured with approvers. The Approval Comment states: "Auto-approved because this account does not requi

470
GloriaB
BeyondTrust Employee
W
W1z4rds123Newcomer
asked in General
Allow endusers to watch their own session recordings

Hi, is there a way to allow endusers to watch their own session recordings?I had a developer who wanted to review a 5 hour SSH session he ran to look foir a mistake, however I cant seem to find the function to enable it for him?

661
J
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Nov 11 - Nov 18)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021620 - Is 24 hours the minimum time a password can be rotated? What options are available for changing password frequency? KB0021654 - Discovery issue for directory query - Error "Selected Smart Rule does not contain any scan targets" KB0021656 - Users with delegated access to Analytics and Reporting cannot download subscription reports KB0021672 - Analytics & Reporting process daily failed - File system error: A string store or binary store with a compatibility level of '1050' is at the maximum file size of 4 gigabytes. KB0021752 - Secrets deleted from Secrets Safe are not removed from Secrets cache KB0021757 - RemoteApps mouse clicks not recorded when using Microsoft Edge browser KB0021761 - Last Login date does not reflect correct date or time after scan

280
GloriaB
BeyondTrust Employee
N
NectarNinjaApprentice
asked in General
Password rotation ever x amout of time

¿Is there any functionality to rotate passwords every set amount of time?Basically, we want the account “admin” rotate every hour, or every 8 hours. We only can see the time for “at least” 1 time in the day or multiple if the account rotates every check-in but no every hour lets say.HAve you encountered a customer that solicited this? How would you go about it? Many thanks!

1171
GloriaB
BeyondTrust Employee
N
naidu_jstsRising Star
asked in General
LDAP for Role-Based Access not working

Can BeyondInsight support LDAP for Role-Based Access? As we are unable to sync users once we have configured LDAP for authentication. we tried adding users through ldap in users and trying to authenticate, it does not work as well. Any guides or suggestions would be a great help

963
J
BeyondTrust Employee
N
Nagapriya JRising Star
asked in General
Functional account test password is failing- Password Safe

Functional Account test password is failing and so we are recieving the below error. Can anyone please help on this. Verify Managed Account on Active Directory system: Domain=UGNX.local, PreferredController=, UseSsl=True, EnforceCertificateValidation=True, Account=(AccountName=s_pr, DistinguishedName=, SamAccountName=s_pr, UserPrincipalName=s_pr@ugnx.local, DomainName=UGNX.local, Privilege=, SID=S-1-5-21-2902959944-561351360-3437842006-37045, DisableAtRest=False) FunctionalAccount=(AccountName=srv_BT_Win_FA, DistinguishedName=srv_BT_Win_FA, SamAccountName=srv_BT_Win_FA, UserPrincipalName=srv_BT_Win_FA@ugnx.local, DomainName=UGNX.local, Privilege=, SID=, DisableAtRest=False) Querying managed account attributes... Search attributes for SID=S-1-5-21-2902959944-561351360-3437842006-37045 ValidateActiveDirectoryCredentials - domain: 'UGNX.local'; username: 's_pr'; useSsl: 'True'; domainController: 'UGNX.local'. Ignore Errors=False, Trust First Certificate=False Subject=CN=UGX1ADDC11N01.UGNX

2238
N
nemer.scafutto
nemer.scafuttoApprentice
asked in General
SSH authentication feature in MacOS via BI/PS

Dear all, A question: The ssh authentication on MAC (MacOs) is working via BeyondInsight\Password. What are the settings for authentication in the Mac graphical interface via PAM?I received this information below, where my developer team said that they would like to perform this entire process via PS/BI:"In step 1 - SSH would be enough for developers to install tools that depend on the terminal and run the build of iOS apps and perhaps unit tests in previously configured projects. In a slightly more complicated way, it would also be possible to submit apps to the Apple store. This submission requires a MAC device and is usually done via xCODE or the Transporter app, which are visual, but it is possible to submit through the configuration of tools such as Fastlane.In step 2 - Some configurations of Apple's iOS projects need to be done via xCODE, which is essentially visual. Development and debugging via xCODE and simulation of apps in the iOS simulator also require the graphical interfa

1952
nemer.scafutto
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Nov 4 - Nov 11)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021387 - Unable to login to web console when user is in child domains - Logon user missing permissions and roles - Directory Queries do run against the parent domain KB0021502 - What best practices should be done for on-premise appliance implementation? KB0021630 - Password Safe SSH fails - RSA fingerprint of the target system not recognized - Not sending HMAC in SSH Connection attempts - SSH client: No matching host key algorithm found KB0021686 - Functional Account test fails. Error details openid-configuration: Service Unavailable KB0021707 - Notification Configuration does not show all of users in list KB0021722 - Auto Shrink setting creating database locks affecting performance KB0021727 - How to troubleshoot delays when logging into Password Safe Cloud

200
GloriaB
BeyondTrust Employee
A
AshaNewcomer
asked in General
how to onboard multiple ubuntu VM's over the XRDP

how to onboard multiple ubuntu VM's over the XRDP

1351
P
BeyondTrust Employee
Devin Churchill
BeyondTrust Employee
Devin ChurchillBeyondTrust Employee
published in General
Customer Success Quarterly - 2024-Q4 - Password Safe

Hello! Last month our Chief Customer Officer, Sean Cashin, provided some information on our upcoming dedicated user community. I’m excited to announce that BeyondTrust launched our new BeeKeepers community on Monday, September 16th! Why BeeKeepers?The name BeeKeepers was born from the idea to protect and secure privileged identities, along with the paths those identities follow in order to gain privilege, aka Paths to Privilege. What does the BeeKeepers name mean to us?Imagine a company’s data and secrets as the honey in a beehive. BeeKeepers take care of the hive, protecting the honey and honeybees, from predators the live to steal the honey, damaging and destroying the hive. Now imagine you, BeyondTrust customers, IT Admins, SOC professionals, and CISOs are the BeeKeepers! And honeybees are identities – human and non-human – continuously travelling along their flight paths, the Paths to Privilege, collecting pollen and making more honey. BeeKeepers protect the honeybees’ path and con

1090
Devin Churchill
BeyondTrust Employee
raymondus
raymondusApprentice
asked in General
How to upgrade UVM 2016 to UVM 2022 in A/A site

I have a customer using 3x UVM2016 in A/A mode and want to upgrade to UVM2022 A/A.Problem is, their existing UVM2016 are all SQLFree. Now we want to move to 1x UVM2022 with SQL as primary + 2x UVM2022 SQLFree.What is the best practice to do the upgrade for all nodes? If i want to upgrade just primary appliance from UVM2016SF to UVM2022SQL, is it okay? Can i just level everything, add new node, config as primary, and turn off the old node? What will happen to existing session records? Can we bring them from old appliance to new appliance? Is there any other consideration? 

891
J
BeyondTrust Employee
S
BeyondTrust Employee
SaqerBeyondTrust Employee
posted in General
PasswordSafe Session Manager CPU Hight Utilization

Hello, What is the list of reasons the PasswordSafe Session Manager utilizes high CPU, other than well known the SCP protocol issue in version 23?Because its often behavior in PasswordSafe and multiple customers are complaining about it.

1021
GloriaB
BeyondTrust Employee
O
Olaf OhmanNewcomer
asked in General
Searching in Password Safe

I am trying to search accounts in Password Safe.  I am looking for accounts that are just admin but I have accounts that are netadmin as well that are showing.  Is there a way to do an exact match when searching in Password Safe?  I tried ‘admin’ and “admin” with no luck.

623
MikeK
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Oct 28 - Nov 4)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021165 - How to add SAP as a Managed System KB0021570 - How to onboard an Oracle Database hosted on Amazon Relational Database in Password Safe Cloud KB0021599 - What clustered databases are supported? KB0021612 - Users with auditor roles are unable to view all completed sessions KB0021614 - Release request emails and request response emails are going to all users KB0021634 - What different ways can Service Now ticket system be integrated with BeyondInsight Password Safe? KB0021652 - Enhanced Session Audit (ESA) deployment fails Error code 1219 KB0021657 - LDAP directory credentials error: The credentials entered failed to validate - How to create bind credential for LDAP server such as Redhat IDM KB0021670 - After disabling the standard web console user account, the privileged mapped dedicated

450
GloriaB
BeyondTrust Employee
S
SFARising Star
asked in General
RDS Server Hardening and browser hardening when PAM launches session via RDS server

Hello TeamThe application session launched via the RDS server allows users to access files placed in the RDS server desktop etc, if we launch the web browser and do ctrl + o . and then navigate.We can also launch cmd and powershell etc. What are recommended hardening for applying segregated access within the application sessions launched via the RDS server as its one single user profile being used for the RDS sessions.

4096
N
BeyondTrust Employee
V
VigneshNewcomer
asked in General
Error: "Managed system, account or application not found"

ErrorEnd user facing “Managed system, account or application not found” error while launching the application sessions, also all the configurations are fine from PAM.Please, share your thoughts to over come.

1981
GloriaB
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Oct 21 - Oct 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021620 - Is 24 hours the minimum time a password can be rotated? What options are available for change password frequency? KB0021660 - Editing an Active Directory user in User Management error - There are one or more invalid fields KB0021678 - Unable to delete Inactive Scans from the web console KB0021689 - Web application freezes or hangs and credentials are not entered when application is configured to use AutoIT Passthru

470
GloriaB
BeyondTrust Employee
N
Nagapriya JRising Star
asked in General
How can we sync the Azure AD FS with Password safe.

We would like to onboard the windows servers present in Azure. so we would like to sync Azure with Password Safe. Is it possible. If yes please let us know the steps to do.

1001
M
BeyondTrust Employee
N
Nagapriya JRising Star
asked in General
Backward slash in the Beyond trust Password Safe API

We have stored the secrets in Beyondtrust Password safe and calling those secrets via Beyond trust API. This secret contains the single backward slash and in the Beyond trust API is escaping it by double backwardslash .  This secret is been used for encryption and decryption already the setup /configuration is been done they cannot change the key now. How to handle this?

1107
P
BeyondTrust Employee

Badge Earners

  • BCIE: Privileged Remote Access
    Rupak_Sahahas earned the badge BCIE: Privileged Remote Access
  • BCSE: Password Safe
    Rupak_Sahahas earned the badge BCSE: Password Safe
  • BCIE: Password Safe
    Rupak_Sahahas earned the badge BCIE: Password Safe
  • BCIE: Endpoint Privilege Management - Windows
    Rupak_Sahahas earned the badge BCIE: Endpoint Privilege Management - Windows
  • BCA: Privileged Remote Access
    Murtuza Sadriwalahas earned the badge BCA: Privileged Remote Access
Show all badges
Terms & ConditionsCookie settings