Endpoint Privilege Management

The following articles were published last week. New Knowledge Base Articles: KB0021710 - Remote PowerShell and EPM-W authentication message behavior KB0021723 - HP PC Hardware Diagnostics prompts with UAC after EPM-W message KB0021726 - Endpoint Privilege Management vs PowerBroker terminology glossary

The following articles were published last week. New Knowledge Base Articles: KB0021713 - pbuninstall uses high amount of memory and CPU and is not behaving correctly on Ubuntu18 KB0021714 - User assigned to a Role Based Policy in EPM-L is unable to use the policy KB0021725 - 6101.53 Error accessing Message Router statistics error in msgrouter and pb.eventlog is not l

Hey all,We’ve been looking for a way to effectively audit what privileges are used by a user or application with an elevated token from EPM in order to better scope our custom tokens.  We have enabled privilege monitoring within our policies, but it doesn’t look like that generates information (or maybe it does, but it’s not aggregated anywhere). The closest we’ve gotten is looking at the audit logs in ‘C:\ProgramData\Avecto\Privilege Guard Audit Logs\’.  This directory houses XML files which seem to contain some information about what happened when using an elevated token. Here are two samples:<AuditLog>    <Application Type="exe" FileName="c:\windows\system32\dllhost.exe" CmdLine="C:\WINDOWS\system32\DllHost.exe /Processid:{1F2E5C40-9550-11CE-99D2-00AA006E086C}" Description="COM Surrogate" FileHash="C521025C55687C1F29B1F3A3C69B3D152CE84981" Certificate="Microsoft Windows" />    <AuditRecords>        &lt

How to Conduct a Comprehensive Policy ReviewRegular policy reviews are essential to maintaining a secure, compliant, and efficient environment. A well-executed review helps identify weak points in policy rules, adapt to organizational changes, mitigate risks, and support ongoing compliance. While this guide offers general steps and best practices, every organization’s needs are unique. We recommend tailoring these guidelines to your specific environment and policies and consulting your BeyondTrust account owner if you need additional support.We recommend performing a professional, in-depth review annually, complemented by an internal semi-annual review. If your organization undergoes frequent changes, more frequent assessments may also be beneficial.Note: BeyondTrust offers Health Checks and policy review assessments for organizations seeking in-depth support or an objective perspective on their policies. Step 1: A

I want to prevent administrators from creating shared folders on servers.

Is there any way to create an application group with JIT notification Only for application that requires Elevation( Target Audience: Standard user)?Example scenario: If end user launches powershell under admin context then EPM should prompt them with JIT notification. 

Has anyone encountered a case where the cloud adapter is not installed, but the service still shows in the services view. Attempting to install then generates the below error (Yes, I’m using the proper command line variables). I believe that artifacts still exist in the registry and it is causing this error. Is there a ripper tool available to completely remove older reg entries/files from previous installations? My alternative is to scour the registry and manually remove any reference to the cloud adapter. 

If any Process starts with admin rights added to token, then won’t it be possible to give control of that application while sharing screen in a Microsoft Team’s or Google Meet call?

Hello, on EPM Windows 24.3 client , when the client is first installed and computer is not restarted , we are seeing that on-demand rules (run as admin ) still trigger UAC. All other actions trigger EPM prompts. Also, the policy gets applied as expected but it cannot be refreshed. e.g. while deploying the policy is v.10 then the computers gets the policy v.10 but when we do refresh it gives message “check internet connectivity ..” If we update policy to v.11 it wont get applied. PMC console is reachable for the hosts. Once the computer is restarted , policy can be refreshed as well as the on-demand rules also start working. Policy has on-demand rules enabled . (On-demand integration setting is enabled to apply to run as admin option). We do not want to force users to restart their computers. Is there any workaround ? Running the PG Tray Icon file shows the icon in task tray ( by default it is not available before restart) but it cant refresh the policy for above mentioned reason. 

The following articles were published last week. New Knowledge Base Articles: KB0021683 - Sequoia pop-up when opening unsigned apps - "App Name" not opened KB0021694 - Error 1603 when installing CCH Axcess via an EPM-W elevated application rule KB0021703 - Changes to the EPM-W QuickStart policy to address Microsoft Narrator behavior

Has anyone had issues with Windows11 24h2? The support matrix shows its not officially supported, but I’m curious if anyone running it has had issues. We’re currently running the 23.9 client and 23.8 cloud adapter

Hi, Scenario 1: The account filter is not functioning for the workstyle we applied. We used an Azure AD group to block the application in this workstyle, but the account filter does not work for the "Block App" workstyle. Instead, it qualifies for other workstyles. To clarify, we have listed the "Block App" workstyle at the top and the other workstyles below it. Scenario 2: When we remove the account filter and apply a computer filter by adding a hostname entry, the created block application rule will function correctly. Is the EPM policy workstyle Account filter not functioning with Azure AD groups on Windows?

Hello, are there any caveats while uninstalling EPM windows components ? We have installed the Package Manager via SCCM which further installed the agent and adapter . On some of the computers we are not able to un-install these components from Add/Remove programs as well as CMD/PS using msiexec and GUID. user account in local admin group is being used to run these programs as admin. No agent protection is configured. Order of removal is PM agent. Adapter and then Package Manager . Tried deleting computer from EPM console before above steps as well. On some computers PM agent removal asks to close other open apps such as notepad. excel etc Adapter Version: 24.6.714.0Client Version: 24.5.361.0Package Manager Version: 24.6.697

Hi Team,Unable to run DISM or SFC commands on the user's system. I tried opening CMD as an Administrator, which prompts the BT pop-up. We approve, but it still doesn't allow me to proceed. I also attempted to open CMD from Task Manager but encountered the same issue.

The following articles were published last week. New Knowledge Base Articles: KB0021537 - EPM-W rule not matching Sublime Text Editor when using publisher in definition KB0021624 - EPM Cloud JIT Application Access walkthrough KB0021662 - When filtering Analytics in separate tabs they are not independantly honored

The following articles were published last week. New Knowledge Base Articles: KB0021676 - Error: pbguid Exiting failed to read settings file /etc/pb.settings - general SQL error "

Has anyone seen or reported in various version of the software that the system tray icon randomly does not display?Some things I do to get the icon back, but doesn’t work 100% of the time is disable the Avecto service and end all PGSystemTray processes.  Re-enable the Avecto service and run the Privilege Management software from the start menu.  About 80-85% of the time the icon gets restored, however there are 10-15% of the time it looks like something is there but does not display properly. 

The following articles were published last week. New Knowledge Base Articles: Discovery policy template structure for EPM-W Endpoint Privilege Management for Mac off network setup with Password Safe Cloud COM class rule getting UAC instead of the expected EPM-W designated user message

Hello Everyone ,We would like to implement a policy that blocks the execution of an application if it is from an external source, even if it has the same publisher and version as one available in the Company Portal/Intune. However, the policy should allow the installation of the same application (with the same publisher and version) if it is from the Company Portal or Intune.Our goal is to prevent the execution of any externally downloaded applications, while permitting installations from Intune or the Company Portal.Example:For Notepad++ version 8.7, the policy should block its execution if installed/downloaded from an external source, but allow installation if done through the Company Portal or IntuneCan this be achieved ?? if yes, how can this be implemented? Appreciate in advance!!Regards,Suresh

Hi guys, I’ve been assigned a case to block portable apps on a Windows desktop using EPM-W. What is the best way to target any portable apps on Windows? I have a portable application (FreeCommanderPortable.exe - this is just for testing, real-world apps can be anything) with the following criteria:It has a valid digital signature The .exe file can be originated from USB stick, internet download, or file sharing The .exe file can be moved to another folder/drive It doesn’t trigger UAC when run The file name can be changed to anythingI tried creating an application group rule that targets any application ("*"), but there were many false positives, as some legitimate applications sometimes depend on each other.The best configuration I can think of is to target if the publisher or the app name contains the string 'portable'. But not all portable applications have this string (e.g., if renamed).Has anyone

Hi Team,Unable to get refresh policy option on the system tray icon after upgrading EPM cloud  adaptor version in 24.5.1037

EPM Windows: How does the AD group synchronization work for AD group filters in workstyle? Currently when we remove user from AD group, EPM policy is still being applied to that user, even though he is not part of the AD group which is added as filter in the EPM policy.

The following articles were published last week. New Knowledge Base Articles: Unable to run client project in debug mode after updating to Xcode 16 Endpoint utility - Endpointutility.exe explanation of commands