Endpoint Privilege Management

You asked, we listened…. with over 200 votes in our Aha! Ideas portal, the most popular feature request for EPM, and it is here….Policy Difference. Users will be able to compare policy revisions, pinpoint changes, track who made them and when, solving for auditing and streamlining policy troubleshooting use cases. This feature presents differences between two policy revisions in an easy-to-read, text-based format, allowing for enhanced control over policy management. Save time and gain full visibility into policy changes with our intuitive policy revision comparison tool, scheduled to be released in EPM Cloud 24.6. Here is a sneak preview:  

The following articles were published last week. New Knowledge Base Articles: KB0022541 - Constrains violation when installing PMUL with RNS "4012.01 Failed set Host in Registry Name Service" KB0022544 - Is it possible to manage the password for pblight? KB0022549 - Why does the pblighttpd.log file need execute permissions?

The following articles were published last week. New Knowledge Base Articles: KB0022516 - How to configure Okta to be used as an IdP for EPM messages KB0022522 - Unable to integrate AWS S3 Bucket SIEM into EPM Cloud results in error: Failed to validate Settings KB0022528 - Is there a way to setup an email alert for JIT requests?

Hi all,Can we uninstall EPM components via Intune without using GUIDs in Uninstall Command.After update of every version of components, the GUIDs are changing and Intune doesn't have the capability of auto fetching updated GUIDs.So, are there any constant commands that can be used for uninstallation via Intune?

Does anybody use EntraID joined Windows 11 devices with Intune? We have an issue with Remote Helpers not being able to see the UAC prompts when remoting in to other user’s machine as the prompts sit inside the Windows Secure Desktop. I have tried to disable the “User Account Control: Switch to the secure desktop when prompting for elevation” and rebooted my device but still unable to see the message from the secure desktop.

I am trying to modify User Account Control (UAC) settings on my test device where BeyondTrust Privilege management (BTPM) components (client, adapter, and package manager) are installed and running as expected. I am trying to set UAC as ‘Never notify’ but I am getting an error which says, ‘You must be logged on as an administrator on this computer to select this setting’. I am attaching the screenshot as well.This is required to be modified by few users in our environment for application installations, running scripts etc. Can anyone let me know if this modification of UAC settings can somehow be accommodated in BTPM Policy?

The following articles were published last week. New Knowledge Base Articles: KB0022499 - Windows startup issues with EPM-W - black screen after reboot KB0022506 - How to block WhatsApp install through the MS Store via EPM-W policy rule

Hi Community,we are rolling out Windows 11 at the moment and with each Windows 11 device we add the low flex policy (we call it our standard policy) to each client. Doing that, many people are complaining that applications they had on their former Windows 10 device are no longer there. Sure, we wanted to reduce the number of the overall applications used, as usually nobody knows how these apps made it to the machine of the user 😊. But -and this is the reason for starting this discussion- what we do not want is to granting higher permissions to the users.What are your best practices to get this under control better? Some guidance on that would be really appreciated.

The following articles were published last week. New Knowledge Base Articles: KB0022138 - Deploying Beyondinsight for Unix and Linux (BIUL)

We get the following error when trying to add a trusted certificate to the keychain from terminal:  SecCertificateAddToKeychain: Write permissions error We’ve tried with sudo and with that we get the following error after being prompted by the OS for an admin user name and password:  SecTrustSettingsSetTrustSettings: The authorization was denied. Any insights into how we can add certificates to the keystore would be greatly appreciated.  Thank you!  

The following articles were published last week. New Knowledge Base Articles: KB0022408 - Not able to validate settings for ServiceNow in JIT Access Settings KB0022429 - MSI installs using Package Manager fail "Error 1618 (Another installation is already running)" KB0022448 - Endpoint App compatibility for 24.5 - Endpoint App missing on some clients

We have acrobat.exe wanting to launch in an elevated mode.  It is hitting the ‘add basic admin’ rule in our low flex workstyle.  We have a message attached to this that allow for admins to input their credentials.  This works.  The problem is that adobe seems to want to launch acrobat.exe elevated for updates.  I don’t know that it’s a good idea to always launch adobe in an elevated mode so is there a better way to control this behavior?  Any thoughts or ideas are greatly appreciated.

Maybe I’m missing it, but is there an easy way to filter the view to only show events that were generated because the rule matched on parent process. I’d like to weed out all the spawned child events from the view. I do believe this was possible in the v1 of analytics.

Hi everyone, I have users unable to clone repos from our Git repos using Microsoft Visual Studio using elevated permissions. Same issue that KB0020044 describes. That KB says to update to EPM-W 24.1 and the issue would be fixed, but I’m still having this issue. Does anyone have users that use Visual Studio and Git in this manner? Is it working for them and if so, did you have to do anything special to get it to work? Thanks!

How to get the installation file PMC Settings XX.pkg and BI Settings XX.pkg for installing in Mac machine?

Hello, Right now I have a content rule in place to block modification of a certain file. It blocks the ability to edit but I can rename the file with a High Flex Workstyle. Is there a way to lock down the ability to rename that file via explorer in the High Flex Workstyle? Thanks,Jiawei 

Does anyone else have this issue, during deployment of PMC Package Manager in Intune Autopilot & MS Endpoint Manager OS Provisioning, it downloads the 2 components, the client and the cloud adapter and then when other Intune/MECM MSI packages are coming in, there is error 1618 (Another installation is already running), this can happen vice versa, depending which tool runs the MSI first, Package Manager or Intune/MECM. We are currently thinking of getting rid of Package Manager and use these deployment tool to install these 2 components, so such a clash doesn't happen. But if anyone else has better ideas, most welcomed.

The following articles were published last week. New Knowledge Base Articles: KB0022186 - Warning occurs when copying files to Azure File Share when EPM-W is running KB0022226 - Azure Files incompatibility with EPM-W features using Alternate Data Streams (ADS) KB0022370 - Domain authentication fails when pre-Windows-2000 domain names aren't supported

HI All, Can you please provide me any one for the answer step by step. thanks and looking for your support.

Good day.  We have been testing EPMfW v25.2 in our environment for a little bit and thought we had some good progress…. until we starting increasing our deployment.  Post upgrade with 25.2, we are seeing many instances where users are being prompted for a challenge/response code or to elevate (depending on workstlye) when launching simple items like registry editor or task manager.  None of these require elevation when launch as a standard user in any policy we’ve deployed.   However we have numerous instance of this happening.  version prior 25.2 weren’t doing this and it seems that 25.2.40.0 isn’t doing this either.  There are some vague hints at something occurring when reviewing release notes in 25.2.11.0 https://docs.beyondtrust.com/epm-wm/changelog/privilege-management-for-windows-25-2-11-release-notes.  

After installing PrivilegeManagementPolicyEditor_x64_v25.2.40.0.exe on workstation, I am tying to connect to the BI appliance.I went into the BI appliance and created a new Installer Activation Key. Entered key details, Beyond Insight Server and Workgroup Name.  For BeyondInsight Server, “test” successful.  However, once I select “connect”, get “Failed to connect. Please check server details.” BT Self Signed certificate with clientinstaller installed on client machine "C:\Program Files\Avecto\Privilege Guard Client\EndpointUtility.exe" /bi /c /debugBeyondInsight Connection Settings:Connection Method. . : OAuth (Configured)URL. . . . . . . . . : https://xxxx/EventCollectorInstall Identifier . : xxxxxxxWorkgroup. . . . . . : BeyondTrust WorkgroupTesting connection...Unexpected communication error.Error 0 : An error occurred while sending the request.

Can someone please assist with how to switch between policy distribution models?I am trying to prepare for the EPM-W lab assessment, and one of the items states: Explain how to switch between the policy distribution models.I have searched my notes from the training, the BeyondTrust Knowledge Base, support documentation, and all online resources I could find, including this forum, but I have not found any information on how to switch between the different policy distribution models.Can someone provide information on how that would be done or where I can locate specific information on this?Thank you in advance.

The following articles were published last week. New Knowledge Base Articles: KB0022371 - Unable to elevate with EPM-UL and sudo - Error 8523 Client failed to contact remote host