Endpoint Privilege Management

The following articles were published last week. New Knowledge Base Articles: KB0022889 - SSH connections fail using pbrun in profile.d scripts (VSCode) KB0022904 - EPM-UL install fails "Error this installation is for Privilege Management for Unix & Linux package creation"

The following articles were published last week. New Knowledge Base Articles: KB0022879 - Package Manager not preserving proxy settings KB0022887 - JIT requests stuck in the pending status in ServiceNow KB0022894 - Cannot see any EPM policys in BeyondInsight "No records to display"

getting error of failed to install performance counter while installing privilege management console adapter application. Does anyone know how to resolve this issue

Hi all, has anyone seen the following issue we have been experiencing?Autopilot pre-provisioning has problems in the final stages if the EPM agent is installed during the Hybrid build and the OS level is Windows 11 23H2 July 2025.The Avecto driver (PGDriver.sys) seems to be clashing with the Autopilot final OOBE stage preventing the device from finishing on the correct Windows logon screen

The following articles were published last week. New Knowledge Base Articles: KB0021603 - Meta Oculus install fails with EPM-W 24.3 and higher KB0021609 - Visual Studio NVIDIA installs fail when EPM-W admin token is used KB0021617 - Unable to run client project in debug mode after updating to Xcode 16

Howdy folks, It’s been a little over a week since the new JIT Admin feature was released and so I wanted to share a little bit of what I’ve learned while using it.  What is JIT Admin?JIT Admin is a new feature in EPM (SaaS) 24.7, where a standard user can submit a JIT Admin request directly to the Privilege Management Console. Once approved, the standard user is put directly into the BUILTIN\Administrators group on their system, becoming a ‘true’ admin for a specified amount of time.This feature is available on both Windows and Mac.  How do I enable JIT Admin?​@Jens Hansen made

Hi!Making changes to some of my policies inside BeyondTrust EPM. Could someone help me understand, because I feel lost. I have a policy, that comes from the Quick Start Template - regarding system settings options ['Authorize - System Preferences']. I checked the easiest one for testing - date and time settings. I set it up to be allowed + message 'Allow Message (Audit)'. Unfortunately, my test device still requires admin credentials when trying to change the 'Set time and date automatically' for example, as seen on the screenshot... Is there something I'm doing wrong? Using Sequoia 15.6.1  

Hi AllWe are facing one issue in our policy for windows assets. our requirement is1.when user will try to elevate itself by executing any exe file using "run as different user" (shift+right click+run as different user) user should get the EPM message asking for reason.2. We have created on application group and rule and added it high flexibility work style.3. when user is trying to run the CMD file as different users, user is not getting EPM message to ask for reason. here what I did on my LAB.create on application group and added eclipse.exe in it create the rule under high flex policy , and used the group. I have placed this rule at top so that it gets enforced and not overridden by other rules . Placed it above Add Admin -High flex I have added below rulesmessage : All Message(yes/no),Access Token : Add Basic Admin Rights,Raise event : on Enabled: Enable When

OverviewThis document provides guidance on how to use the Swagger UI for a no-code solution to moving computers to computer groups. IntroductionFor those who want to be able to bulk move computers in EPM SaaS, there is no GUI-provided way to do so. That said, we do provide the API method to assign computers to a group ID either as a one-off or in bulk via a CSV. As support will not provide break/fix support on troubleshooting code choices. The guidance here is based on using the Swagger UI provided with EPM - available with BeyondInsight on-prem, and EPM SaaS. Remember, with great API power comes with great API risks: Test. Test. Take snapshots of where things were for faster roll-back (e.g. download CVE of computers pre-change). Test before bulk moving production. Please. If the API isn’t returning the anticipated data or if the documentation is followed

Want to create 2 policies-one for Mac and one for  Windows users.Where All applications should be blocked from installation unless they're on a whitelist (using the publisher's information). However, users should still be able to change settings like Time, Region, and Network.When a user requests an application that's not on the whitelist, an email shd be sent to our Helpdesk. And a technician will then approve or deny the request.

The following articles were published last week. New Knowledge Base Articles: KB0021256 - EPM-UL pbbench fails with error 8523 Client failure in SSL_connect - Unable to initilize SSL to policy server KB0021403 - EPM-UL error - 3811.3 This server is not a License Server KB0021407 - How identify roles contains specific hostgroup for EPM-UL

The following articles were published last week. New Knowledge Base Articles: KB0021490 - Analytics unlicensed event error - Details unavailable: Computer requires a licensed policy for event details KB0022817 - Analytics is slow or times out after upgrade to EPM Cloud 25.6 MR1

Hi all,Has anyone else seen massive performance issues during logon with Agent Protection enabled (on Windows 11 endpoints in my case)?I have a customer that has been seeing problems for a while, and I also got my own environment set up and running in the last week and see the same thing.Basically, after a clean logon to the device (happening on multiple, not isolated to 1 or 2), it just takes forever to get a usable desktop. For me, it can take a minute or more for even the taskbar to show.To test, I created an identical EPM policy to my production policy, but with AgentProtectionState=0. When I flick my machine over to the associated Computer Group it is responsive again during logon (reboot, log on; taskbar loads almost instantly, apps load, desktop responsive…. normal operation).Running latest versions of agent and client (leveraging Package Manager for that and double-checked manually).The customer that raised it has been having issues f

Hi everyone! I am trying to filter a workstyle to only the built-in local admin.I dont think wildcards can be used in the SID field and using just the username is not super reliable.. but seems to be the only option...  Anyone done this and have any tips?

The following articles were published last week. New Knowledge Base Articles: KB0021482 - Windows PowerShell (Admin) from start menu WinX menu does not match expected EPM-W on-demand rule KB0022376 - EPM-M limitation with Network Link Conditioner tool KB0022803 - Application definiton does not 'paste' after being successfully copied in Chrome

Hi all -- MS released an update for Autopilot (2508) and since then, we are seeing our builds crash. If we remove EPMfW, build completes successfully. Is anyone else seeing this?  We just started seeing this on Monday, Aug. 25

Hi Everyone, We are an on-prem BeyondInsight appliance EPM customer for almost 2 years now and need to upgrade our agents as well as our server appliance.  Migrated over from Powerbroker. Someday in the future may go to cloud but not in the works yet.Currently on 23.9.225 for our agents and BI Server is at 23.1.0.2407.  I was told two different things by support, EPM support stated that the agent and server are independent of each other and can be updated separately whenever, and I was also told that the Server needed to updated first by BeyondInsight support.  Just looking for some guidance or experience on upgrading to the latest version on-prem.  We have close to 12,000 pc’s, so I would like it to go smoothly without much interruption.  Thanks for any help!

Hello Everyone.This issue is related to the Challenge/Response option on the EPM message.When we enable the Challenge/Response option on the EPM message, we are not receiving the expected EPM prompt while uninstalling certain applications such as Forcepoint, Cisco, and Symantec.However, when the Challenge/Response option is not enabled, the EPM prompt appears correctly during the uninstallation process.have anyone faced the same issue? 

The following articles were published last week. New Knowledge Base Articles: KB0022740 - pbrun fails with error "Cannot access sharedlibsolarisprojects /usr/lib/libproject.so" KB0022781 - "3430 Insecure operation" error when installing epml-cachedclient or epm-client packages KB0022785 - Linux Server with Palo Alto firewall fail to connect with error 3003.01 Could no

The following articles were published last week. New Knowledge Base Articles: KB0021723 - HP PC Hardware Diagnostics prompts with UAC after EPM-W message KB0022759 - PMR Reports is missing or disappears after upgrade via BTUpdater to 25.1 KB0022795 - OneDrive errors when in EPM policy "OneDrive can't be run using full administrator rights"

The following articles were published last week. New Knowledge Base Articles: KB0022750 - How to upgrade EPM-W or EPM-M when in Pathfinder or Cloud KB0022760 - How are EPM workstyles and rules evaluated? - Examples of QuickStart policy logic KB0022763 - What is the best way to manage VDI or short lived endpoints in EPM Cloud or Pathfinder?

I’m working on a solution to onboard a local user account created during the Jamf provisioning of Mac assets to Password Safe Cloud. I have EPM-M installed on the endpoints and they are connected to Password Safe. When I run discovery scans on the endpoints, the local accounts are not discovered. I have looked over the KBs related, and nothing seems to explicitly say “Here is what you need to do” when it comes to local account management. To test, I added a test functional account to the local admin group on a test Mac. This is an Active Directory service account, and it fails to login. As far as I can tell, the account needs to actually log into the Mac in order to be locally cached and thus login as a functional account. But having to locally log into each asset is not scalable. Has anyone had success with an AD group being used for your functional account? What am I missing to complete this set up? 

The following articles were published last week. New Knowledge Base Articles: KB0021406 - Is EPM-UL affected by CVE-2022-41556?