BeyondInsight / Password Safe

Hello, how are you?How do you enable the session time for password safe? The session time is extremely short.

Hello, how are you?I need support on how the features in password safe work. What would be the best practice recommendations for the solution and environment? Do you have any documentation? What to enable or not?

Hello, do you know if there is anything in the works to have managed account credentials also be updated in IIS > Management Service Delegation? 

Hello community,I have a question regarding our use of Password Safe. In our organization, we use Password Safe to access privileged SSH sessions. However, a question recently came up: since Password Safe is our only access method to managed Linux systems and credentials are never exposed to users, we're wondering how we could securely perform SCP or SFTP file transfers between two of our managed Linux systems.Has anyone encountered a similar scenario or found an effective approach for handling file transfers in a Password Safe-controlled environment?Any suggestions would be greatly appreciated.

How do I change the administrator password for the password safe console?

Hi Team, I’ve been trying to find the steps/process for onboarding of GCP, Azure and AWS assets. I’ve seen KBA for onboarding of accounts only from these cloud platforms. Regards,Aditya Bhatia

The following articles were published last week. New Knowledge Base Articles: KB0021685 - How to link Active Directory Managed Account to Managed System KB0022470 - Run Unix Shell Script Propagation Action does not work on managed system with custom port KB0022481 - Resource Brokers not properly load balancing session requests

The following articles were published last week. New Knowledge Base Articles: KB0022357 - Error when using API to create secret - 404 or 400 Bad Request KB0022459 - How does PS Cloud handle Disaster Recovery? KB0022460 - What are PS Cloud Security standards and processes?

I have a use case where we are using the domain accounts for accessing Network devices and windows. Say abc.domain@domain.com which is linked to a network device, Windows and an application. Similarly abc2.domain@domain.com, abc3.domain@domain.com. Linked with all the Network device, windows and application.I have done the linking of the managed accounts to systems (Network device, windows and application.)I have configured in the managed account smart rule mentioned that Managed account field=abc.domain@domain.com & Asset smart group= Windows. in the condition i have given the show managed account as smart group. Also mapped the user group to this smart group.We have also got applications which are running with the same account abc.domain@domain.com. applications are in Windows,

Hi, Does anyone encountered scheduled password change fails due to permission denied error however if you use force change password, it successfully changed the password? The system is Ubuntu and I wonder, what’s the difference between those 2 functionality. The account settings option for the Ubuntu managed account is configured to use a functional account when changing password and Use Own Credential is disabled. If I try to simulate the changing of password on the server, the passwd <managed account> command doesn’t work due to an error showing “passwd: You may not view or modify password information for <managed account>”. If I run the command, sudo passwd <managed account>, it requires us to input the sudo password. With this two commands unable to work properly, I wonder why the force change password works? Any idea?  Cheers~!

Need Comparison between Privileged Identity and Password Safe (including features, scalability, audit, troubleshooting, integration, APIs, architecture, User Interface etc etc? Is there any refernce document available to higlight why its a better than PI to management?

We have the following use case:  Onboard the service account to password safeNotify the service account owners with the new password when the password is rotated in password safe. The password need to be communicated to the service account owners for any external service account usage beyond password safe  The service account password should be updated by the password safe on the underlying windows services/scheduled tasks/ IIS application pools.I would like to understand the feasibility on the email notifications, password updates on the services and any challenges that anyone faced while onboarding the service accounts. 

I’ve noticed lately that our system event viewer in is filled with warnings.  Most of them are complete gibberish to me.  Most are like this but with different IDs: CPP: Postpone CQ item due to active Release Request Id:(3753), Expiration time: 5/29/2025 10:33:17 PM UTC - ChangeQueue: id=18576, MAid=663, FAid=, MSid=5, SubDt=2025-05-29 13:33:07 UTC, ChgDt=2025-05-29 13:33:07 UTC, Reason=R, ProcStartDt= UTC, NumFail=, RelID=, ReqID=3751, RemoteCl=false, OWA= These come in sometimes multiple times a minute.  Just for the last 15 minutes, there are 130 of these. There are over 5000 in the past 24 hours.  What is this trying to tell me?

If a shared functional account is used to log into the application server (RDS), users can see files downloaded by others in the Downloads folder from previous sessions. Is there a way to prevent this behavior?

Hello All,We have an existing setup of Beyond Trust u-Series appliances. When we try to access the U-Series appliance portal page, the page is visible requiring username and password. Unfortunately, we have lost the credentials. Is there anyway by which I can get the lost admin credentials back. Please suggest.Thanks,Prasad

Hello TeamThe application session launched via the RDS server allows users to access files placed in the RDS server desktop etc, if we launch the web browser and do ctrl + o . and then navigate.We can also launch cmd and powershell etc. What are recommended hardening for applying segregated access within the application sessions launched via the RDS server as its one single user profile being used for the RDS sessions.

The following articles were published last week. New Knowledge Base Articles: KB0022151 - Is SQL always on required for Active Active environments? KB0022305 - BTUpdater service keeps crashing after update to 3.4.2.1876 KB0022381 - Scan account on Linux Sytems not finding local accounts

Hi,I am new to BeyondTrust.Can I find some Smart Rule examples with explanation?Thanks.

Investigating a requirement to map std user accounts in Password Safe to a dedicated local account (unix in this case) BUT with the same name/format. Unix accounts do NOT have any prefix/suffix additional to their Entra/AD login to PWS account.As a Unix local account, cannot use any account attribute mapping either.The onboarding Smart Rules is ok - we can utilise the regex capability (x characters, y numerics format).It’s the mapping Smart Rule were we have the issue, as this doesn’t provide regex option, mainly suffix/prefix.Any thoughts people?

Hi, We need to onboard GCP IAP application in Password Safe.Would appreciate any help/guidance on automating the login process.Thanks 

Hi All, We expect to close our on premises DC’s in the coming years, and we currently run a traditional RDS farm with F5’s in front to enable the non-SSH/RDP workloads managed by PasswordSafe Cloud…Microsoft RDS licensing options in AWS (AWS is the only answer for us - please don’t suggest Azure!) are very limited and the equivalent would be significantly more costly than the current level. For other internal systems, we’re looking at AppStream2 - has anyone looked at this or other options for PasswordSafe Cloud or are we locked to RDS and the associated costs?Trying to gauge what the community is doing and what experience, if any, is out there 😀 Many thanks in advanceTim

Hello Beekeepers  , I am working on one integration project where i need to give access to password of managed account to users, We will be using disable at rest future to make it true on demand / JIT .  Problem comes in sync, if we leave all default replication to cloud and local it takes about an hour time. i am just wondering does beyond trust has any integration point which can be force ad replication or in cloud ad replication when such a password extracted. 

When API endpoints are changed, how often will this be? With the last big update BI had, some endpoints were depracated. I am curious how often this is going to happen? APIs have become very popular in our environment and alot of our scripts are breaking with these changes. Ex.) In BeyondInsight/Password Safe 24.3, "UserGroupId" has been deprecated.I know the word “Safe” was also replaced with “Folder”. 

How to ensure that even Admin session should be recorded. There should not be an option to avoid Recording.