Endpoint Privilege Management

IntroductionThe overall goal is to provide a framework for confident change management process that keeps users happy, administrators happy, and avoid confidence disruptions that can plague deployments and operations teams for a long while after an issue occurs. 🤐 Preferable PracticesWhen it comes to maintaining a production environment, while ensuring proper testing is occurring, the following is a Preferable Practices guide. The aim of this is to provide an overview of potential structures for segregating testing from production and highlight use cases for staging rollouts with computer groups with a focus on stability, confidence, and operational procedures. > Best Practices are set by each organization and may have different requirements so, please follow your Best Practices as outlined by the change control policies of your organization! Computer GroupsThe core component

Hello.  I’m working on a way to elevate wt.exe.  If I right-click on the windows flag and select Terminal (Admin) or if I right-click on it from within the start menu, I am presented with a BT authentication message (as designed).  I enter my admin creds and it takes me to the Windows UAC.  It is hitting the application group “(Recommended) Add Basic Admin - Restricted LOLBAS” How can I pass the token through?

EPM-L and EPM-UL have extensive ability to log privilege access and sessions. You can use the pbsh and pbksh to log and record unprivileged session, however the problems with that are twofold. Firstly, the pb-shell environments are incompatible with Advanced Control and Audit rules, and secondly, the shell environments are out-of-date compared to modern shell environments. They lack modern features like command argument completion, wildcard completion, directory history stack and others due to their age. Maybe a modern shell environment like bash, zsh or fish will get integrated into the product.The first issue is easily taken care of by normal DAC file system permissions, they are unprivileged users after all. The second issue is more complex and could be solved by just forcing people to use pbksh, but there is a method of logging which is secure, and respects the

The following articles were published last week. New Knowledge Base Articles: KB0021958 - How to turn off JIT admin console for EPM-W on-prem KB0021997 - EPM-W COM class elevation rule fails when 'EnableSvchostMitigationPolicy' is involved KB0021999 - How to configure AWS S3 bucket to work with EPM Cloud SIEM

we encountered difficulties upgrading the EPM client and adapter version on endpoints via Jamf. When the latest version was pushed to the endpoints through Jamf, it did not successfully override the existing versions of the client and adapter.

The following articles were published last week. New Knowledge Base Articles: KB0021465 - EPM-M sudo error - This sudo command requires identity provider authentication, which is an unsupported configuration KB0021643 - Endpoint utility - Endpointutility.exe explanation of commands KB0021958 - How to turn off JIT admin console for EPM-W on-prem

We’re running EPM in a mostly windows environment. Some support/admin users have secondary accounts that have all their elevated AD credentials, like domain admin for example. When we try to run an elevated command prompt it opens it as admin of the current/primary user account. They need to be able to open an admin CMD as the second user that has the elevated AD credentials. Any suggestions on how to pull that off? The users are all in a high flex workstyle. Thanks. 

Hi Team, I am trying PMUL and want to ask if i can block any standard command without pbrun. Example:I want to block the standard ping but without using pbrun ping.ping 8.8.8.8 should be rejected. But for now, i can only reject if user executed pbrun ping 8.8.8.8.Can we do that in PMUL? (right now, i am using role-based policies)I have a case from end-user, they want to block all kind of command except 2 or 3 specific commands.Thanks

Good morning -- I have our Client & Adapter updates enabled in our environment and it should be updating the clients to the latest version of both the adapter and the client. However, my client has stayed on version 24.5.2.3 when 24.7.0.1 is available.  In the update section, it does see we have two devices “awaiting update”.  Am I missing something or isn’t this suppose to occur when the machine checks in?   The machine is online and the console see that it last spoke about 30 minutes ago.  Have I misunderstood and or misconfigured something? I’m new to the management space on the EMPfM side so forgive my slowness. 

Good morning.  We don’t allow the use of mail.app on our enterprise devices so we’ve put a block on it.  No big deal - it was working exactly how we intended.  Now, however, after upgrading to Sequoia, we’re seeing MailCacheDelete.appexauto-launching to delete the cache and EPM is seeing mail.app being opened, causing a block.  While this, generally, isn’t bad, it does cause a bad user experience.  Now, the user gets, seemingly, random blocks for mail.app when they didn’t even launch it.I’d like to block and suppress the message for just this deletion process.  I’d also like to have it continue to provide a blocked message when a user tries to open it manually.Any thoughts on how best to accomplish this? Sample logs:com.beyondtrust.endpointsecurity: [com.beyondtrust.endpointsecurity:EndpointSecurity] Blocking 23252 /System/Applications/Mail.app/Contents/PlugIns/MailCacheDelete.appex/Contents/MacOS/MailCacheDel

I’m interested in auditing certain software and/or commands using EPM, but if I create an audit rule with an application that matches what I’m looking for high in my Workstyle hierarchy, rules that would match lower down will not fire, and if I create it low in the hierarchy the inverse is true. I understand that this is pretty foundational behavior for EPM, but I feel like i’m missing something simple here, or it’s just not possible. It seems like if i want this data, whether it be simply for visibility, or for measuring expected impact of a planned change, I could do one of the following…LOG ALL THE THINGS!!! Update all of my rules to raise a local even and report events, then filter what I want in my SIEM. The downside is that this would be expensive, and result in a lot of noise in the EPM console. Not really an option. Duplicate Groups and Rules!!! Create duplicate “logging” application groups + rules with raise

The following articles were published last week. New Knowledge Base Articles: KB0021898 - EPM-W and BITS transfer - How to allow installation KB0021899 - How to block users from accessing Users & Groups with EPM-M KB0021900 - EPM-M and third party system extensions

How to Block Delete from /Applications in MAC? how to allow Install specific apps in /Applications in MAC?Is there a common configuration for all versions of MAC, as we see its behaving different on every version of MAC.

Starting to use PM Cloud now and looking to see if it is possible to update group assignment using a local scripting job. We used to do this before with stopping services, changing some registry keys, and starting services. This is helpful if we want group membership to change dynamically based on something that might not be in AD.

Hi,Is their any alternative for the port 445 to manage discovery scans for asset in BI-EPM.

Hi Team, "We have configured a policy in EPM-MAC to block the installation of unknown applications. However, when attempting to install an unknown application, the block action does not prevent standard users from proceeding with the installation. When we configure the policy to either 'Allow' or 'Request EPM Message,' it functions as expected, based on the action set (Allow/Request). The issue appears only for the 'Block' action within the application rule, as it is not being enforced properly."Is their any suggestions why it is happening with the policy?

Has anyone implemented a solution that changes the Challenge Response “key” on a frequent basis (Ideally daily).   We have CyberArk, so theoretically could store in their vault but looking to see what options might be available. 

For EPM Windows, is there any way to remove the policy on endpoint agent.I want the turn them into first no policy “monitoring” state in certain conditions. thinking about changing the smart rule. I gave empty smart rule to the machine but latest policy on it remains there.Can I do it on smart rules or something without and rdp? Or I always need to delete the xml under Program Data?

The following articles were published last week. New Knowledge Base Articles: KB0021855 - EPM-W installation fails with error 1603 on Windows 24H2 ARM devices

Hello,What is the best way to apply specific rule(s) to a group of users e.g. a team wants to have yes/no message for elevation for certain commands run in CMD. (others will have Password prompt). I see I can create a new workstyle and assign to AD based user group, but there is a possibility of many such requests and I will end up creating 50-100 workstyles. Alternatively, I can use the SG as designated user group in Password (authentication) Message, but I want yes/no prompt which doesn’t have designated user option. 

if a user is in high-flex, ia user can access the users & groups and then turn themselves into a local admin.  we’re going to block this access by doing the following but I was wondering if there was a better way?Remove from (Recommended) Restricted Functions: Type: System Preference pane; Filename: *;  Auth Request URI: system.preferences.accounts Remove from (Recommended) Restricted Functions: Type: System Preference pane; Filename: /System/Library/ExtensionKit/Extensions/UsersGroups.appex;  Auth Request URI: * Add to Blocked - Blocked Apps: Type: System Preference pane; Filename: *;  Auth Request URI: system.preferences.accounts Add to Blocked - Blocked Apps: Type: System Preference pane; Filename: /System/Library/ExtensionKit/Extensions/UsersGroups.appex;  Auth Request URI: *

The following articles were published last week. New Knowledge Base Articles: KB0021526 - Endpoint Privileged Management for Unix Linux licensing FAQs KB0021758 - LDAP binding to Active Directory on EPM-UL fails with error - pbrun23.1.2-04[947719]: 3005 Request ended unexpectedly KB0021817 - Errors assigning EPM-UL license key - 3802.6 This host is not the Primary Li

The following articles were published last week. New Knowledge Base Articles: KB0021840 - How to add and use a local AD connector in EPM Cloud KB0021847 - EPM-W client failing to install "Error 2738. Could not access VBScript run time for custom action" KB0021852 - EPM with SentinelOne on Windows 11 24H2 - Looping install popups

Hi All,I am trying to get more details on how EPM handles the privileges ( there are few helpful KB articles. Thanks BT team).Q.1 How the agent assigns elevated token? Is there a local admin user created by EPM or the defendpoint service assigns the elevated tokens to processes when requested.Q.2 How the  OS log ( and SIEM log monitoring will be affected) . In Widows Event Viewer I see two additional events per elevated action e.g. if I run an installer that needs elevated right I see1. ID 4688 The standard user account as subject who ran installer with elevated token.     I also see two additional EPM events -2. ID 4688 - Create process “PGMessageHostExt.exe” by creator “ DefendpointService.exe”3. ID 4733 Primary token assigned by DefendpointService.exe to the installer service. Token has standard user.I think event number 1 stays as is (with EPM / without EPM while user is local admin)Q3. How AV scanning is affecte

has anyone gotten the new pmw 24.7 arm64 client installed? the same method weve been using to install pmw x64 msi results in 1603 error. thanks.