BeyondInsight / Password Safe

Hi Everyone I have one requirement wherein Admin and Standard ids are not matching for local dmz servers. Hence i need to do one to one mapping. I have around 400 admin ids and hence i am required to create 400 smart rules.I have checked all the options and dedicated mapping is not possible since account is local and admin and Standard are not matching. I wanted to check is there any API available that i can use to create the Smart rules in bulk using Postman or powershell utility?Awaiting response. thanks in advance  Regards Imran Aliyani

Hi, is there a way to change PuTTY from C:\Program Files\PuTTY\putty.exe to C:\PuTTY\putty.exe as my Default Launch path? 

Hello everyone,We're experiencing a situation in our environment where PSafe appears to be failing to execute or executing pwdadm commands incorrectly on AIX servers.At the beginning of the operation, we noticed that all credentials for which PSafe rotated the password were prompted by the user for a new password change.This is due to AIX adding the ADMCHG flag to the credential after the password is rotated.To avoid this, the original password rotation workflow included the command pwdadm -f NOCHECK <<ManAcctName>>.Even with this command in the workflow, the credential remained with ADMCHG and the NOCHECK flag was not added.So, we changed the command to pwdadm -c <<ManAcctName>> and added two more consecutive executions.After this change, the password rotations no longer prompted the user to change the password at the next login, and the ADMCHG flag was removed.However, an AIX server in our environment doe

Hi,I would like to understand the process for onboarding an AAA server into BeyondTrust PAM. Could you please confirm whether this is supported, and if so, share the necessary steps or prerequisites for onboarding? Regards, M.Sathiya

I’m trying to figure out if this is even possible.  I feel like it is, but I’m probably missing how to accomplish it.So we have 60 something Windows servers running SQL server.  We have 20 something AD accounts that run SQL on these various servers.  Ideally what I’d like to do is build a rule that adds the appropriate linked managed system to each managed account that is running the SQL services on those systems. So the end result would be I could go into each account, and see the system or systems that it is running SQL on.I’d really like this to work automatically so that any time a new server is added, or an account is added to another system, it automatically gets added to the list of linked systems for that account.    I can easily create rules to get a list of all of these servers running sql.  I can also easily create a rule that shows me all of these accounts (they all start with the same thing).  But is there a way to then just link each account to the approp

Hello, we have BI PasswordSafe on-prem . When we do IP Discovery scan against 50+ network devices for some of the devices , IP address is added as an Asset after the scan, instead of hostname , I think IP Discovery scan would just query the DNS and add the hostname as an asset along with IP address as details for that asset. All devices have similar DNS entries (hostname : IP ). But for some devices the scan add hostname as an asset - which is the desired outcome , but for others IP address is added as asset

Hello Everyone,We have a setup of Active -Passive environment for Beyond Trust.We are planning to test Failover for these environments. I am looking for any pointers or document about stepwise process to conduct this failover and process to fail back. Thanks,Prasad

Hi, I am trying delegate the following permission to SAML group but nothing happens with end user permission. Is there a reason for that?Analytics and ReportingLicense ReportingUser Audits Higor

The following articles were published last week. New Knowledge Base Articles: KB0021393 - PMM Login explanation seen in Users Audits KB0022464 - How to upgrade Appliance Management using BT Updater KB0022658 - RDP to U-Series Appliance fails. Error - Remote Desktop can't connect to the remote computer Error code: 0x204

Hello! If the a user is part of two Security Groups and each group has different features enabled (under Configuration > User management > Groups >     Group-Name - Features. Will the user get all the enabled features or only one of the Groups will take preference.

We have discovered that some users are initiating RDP sessions from inside Password Safe Resource Brokers to other internal servers. Please advise on recommended configuration, policy settings, or network restrictions to prevent this behavior.

Hello,We have the following use case related to email notification - Notify certain email IDs with message about password is rotated in password safe. Notify certain email IDs about next password change date.I have seen below KBA article for email notification- BeyondInsight / Password Safe - How to add, change or remove email notificationsDoes ‘release notifications for Managed Accounts’ help with above requirements.I would like to understand the feasibility on these email notifications. Thanks,Prasad

The notes is not getting imported while i am importing the secrets

Hi, I have a use case in place that works fine using Dedicated Account feature, but it covers only 25 accounts. Now my customer wants to expand this for around 5,000 users. Have you guys seen a use case with 3,000 - 5,000 Dedicated Accounts in Password Safe? Does it work fine or I should consider anything.

Is there any documentation or guide to help users to use Copy and Past file in Linux system?

Is there a way to check the number of license assigned to my Password Safe Cloud by UI?

Hi all,I’m in the process of onboarding over 100 local Linux servers into BeyondTrust Password Safe, and I’m looking for a more efficient way to handle FA (Functional Account) assignment during setup.Steps I’ve taken so far: Added all 100+ servers to an Address Group Created an asset-based Smart Rule Set the assets within the Smart Rule to be Managed by Password Safe However, when I try to enable Automatic Password Change Options, I’m only able to assign one FA (From smart rule). Since each server requires a unique FA, manually creating individual Smart Rules for each server would be highly inefficient.Question:Is there a way to automate or bulk assign one FA per server without having to create a separate Smart Rule for each one?Thanks in advance for your help!

Hi everyone,Is it possible to delete the completed session recordings after x days when no longer needed for auditing?For example, some clients have to maintain the records for a maximum of 1yr for auditing, after that logs/records can be deleted.I know there is no option in Password Safe console, Looking for backend alternative methods.

The following articles were published last week. New Knowledge Base Articles: KB0020179 - Error "Secrets Safe unavailable An error occurred when attempting to communicate with the Secrets Safe service Please contact your administrator to resolve" KB0021724 - How to use psrun command KB0021774 - BeyondTrust Discovery tool teste error 400: BadRequest

Hi. I need to configure an Active Active PS configuration. I have installed the managament node and connect it to external SQL database and everything is OK for this. Now I start to configure the worker node and I need to connect this nod to the same SQL database but after I put in the credentials and the crypto key from managament node I am getting this error when click on test > Connection test failed. Could not connect to existing database. Can anyone, please, help me with this...what is the problem, what is the right way to configure an Active/active configuration 1managament/1workernode.

Hello,Please, how do I synchronize user accounts in the domain to managed accounts? To have visibility of all user accounts and rotate the password if necessary.  

Has any one deployed BeyondInsight Password Safe Appliance on Oracle Cloud Infrastructure (OCI)? If yes, which appliance image was used?  Is deploying the appliance on OCI supported by BeyondTrust?

Hi,{This issue is only applicable to MacOS environments}Is anyone facing an issue where, when launching a web application (using PSautomate) via Password Safe in MacOS using the Microsoft Remote Desktop application, there is some sort of caching issue? For example, let’s say I download the RDP file for a web application at "https://app1.example.com"; the Microsoft Remote Desktop will prompt an “RDP certificate warning,” and the user will click "Continue," allowing the browser and web application to launch successfully. Example of “RDP Certificate Warning” However, once they close this web application browser (browser only and not the entire Microsoft remote desktop app) and launch another web application session (such as "https://app2.example.com") using a new RDP fil

Anyone know what is this error related to when doing custom platform plugin?    

Hi I have application API to change password , how can I use it to trigger password change via PAM. For using application host, I am unable to use WINDOWS system . I found this link here-Resource Kit SDK Plugin for PowerShell Scripts -Should I go with above? or propagation action? If using propagation action, what needs to be the platform? I mainly want to do trigger generation of password based of password policy, update it just in the BT DB and not try to apply in system account. I have a windows system with the script and want to trigger change of password from BT .