Skip to main content

General

A general place for Password Safe conversations.

  • 198 Topics
  • 486 Replies
198 Topics
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
published in General
Monthly Buzz - April - Password Safe

Discover What's New in Password Safe 24.3: Enhanced Cloud Support and Security Features As organizations continue to adopt and migrate to cloud, ensuring management of all identities has become more complex than ever before. Addressing secrets sprawl and access management across the entire estate to achieve compliance and maintain security is complicated and requires visibility into more areas than many organizations have bandwidth to achieve. Further, DevOps teams are being tasked with deploying as quickly as possible and are often needing access to the same credentials across teams, while also ensuring least privilege access and operational efficiency is maintained. Read the full blog post here. Latest Available Version: Password Safe 24.3– December 2024 Beekeepers Hot Topics Export Accounts from BeyondInsight “We have one environment of BeyondTrust Insight with scanned accounts and managed accounts. We are planning to setup backup environment at different location with different dom

170
B
Community Manager
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 28 - May 5)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022248 - What are the deployment requirements for Enhanced Session Auditing (ESA)? KB0022263 - Linux server scan executes init.d scripts instead of validating service existence during status check KB0022277 - How long do discovery support logs reside on the server before being purged? KB0022279 - On the Password Safe dashboard Slowest Smart Rules are not shown KB0022281 - How is the first Radius authentication request defined in Password Safe? KB0022286 - After failed hotfix, error messages received on password rotation and test KB0022308 - What causes a High Availability active passive appliance to failover? KB0022313 - How can the Resource Broker be hardened? KB0022314 - How do Resource Brokers work with round robin? Can one be selected for a specific system? KB0022315 - Can alerts or emails be sent when Resource Brokers become unhealthy? KB0022316 - How to troubleshoot a single Resource Broker or find w

40
GloriaB
BeyondTrust Employee
S
SammedPatilNewcomer
asked in General
Managed Account Next change date should consider Last change date

Hello Team, We have observed a issue with PasswordSafe, where Managed Account Next change date is calculated based on Last scheduled change date. If the user changes the password manually, Next change date is not updated to new date based on Password change Frequency (Xdays). The problem observed today, is that teams who have manually changed the password for a Service account ahead of a policy based 90-day rotation, as part of a RFC change window, will suddenly have the service account password rotated automatically again (potentially just a few days later) on the 90-day rotation enforcement date by PasswordSafe - thus breaking their production service. How can we achieve this use case in such a way that Next change date is updated based on last change date (scheduled & manual)?

213
L
K
kimberlyvNewcomer
asked in General
API Endpoints

When API endpoints are changed, how often will this be? With the last big update BI had, some endpoints were depracated. I am curious how often this is going to happen? APIs have become very popular in our environment and alot of our scripts are breaking with these changes. Ex.) In BeyondInsight/Password Safe 24.3, "UserGroupId" has been deprecated. I know the word “Safe” was also replaced with “Folder”.

110
K
B
BartoszApprentice
asked in General
ESA deployment requirements

Hello community, I’m looking for a list of requirements for ESA deployment along with information if SMB3 is supported and which SMB version is the default one? I can’t find this information anywhere in documentation, the only mention about it is this KBA but its 9 months old and I’m not sure if its up to date at this moment. Cheers, Bartosz

245
B
frank.colvin
frank.colvinVeteran
asked in General
SSH using Secure CRT, Winscp or sftp clients

we are rolling out linux/unix managed systems and we are having great success with putty, however our developers user Secure CRT, winscp and sftp clients. does anyone have any advice/guidance?

242
R
B
BartoszApprentice
posted in General
More granular access rights for custom PS Admin roles

Hello everyone, We’re struggling with lack of possibility to introduce more granular access for PS Administrators, there’s an idea for the same More granular access rights for custom PS | All Product Ideas - Public Do you have similar experience with the product? If yes then please share your thoughts on that and like an idea if you find it useful, maybe it will get some attention thanks to that. Cheers, Bartosz

598
R
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 21 - Apr 28)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021742 - How to configure Duo as an Identity Provider for SAML KB0022219 - Workforce Passwords continuously spins (loads) and last synchronized shows 'an error occurred' KB0022222 - Group sync fails when selecting a specific Domain Controller in PS cloud KB0022223 - Unable to create Smart Rule - An unknown error occurred KB0022230 - With Host Headers Restriction State (HHRS) configured, accessing an application or remote session results in error: Invalid session token KB0022231 - AD Webconsole logins fail in active active environments following an upgrade "An authentication error occurred" KB0022234 - Okta SAML integration is failing with 500 internal server error KB0022240 - Unable to rename organization "an error occurred while attempting to save this item" KB0022241 - Password Safe tile Accounts Page explanation in Password Safe version 23.1 and higher KB0022244 - How to manage DRAC devices with Passwor

80
GloriaB
BeyondTrust Employee
T
BeyondTrust Employee
tkellumBeyondTrust Employee
asked in General
Remote App Launch Display Scaling

I wanted to bring this to the community for feedback as it was brought up for discussion during a troubleshooting case for a Password Safe customer, while configuring Remote Applications to be launched via ps_automate.exe It was found that if we expand the Remote App window during the login process, we may see the login screen display look distorted based on the size the window takes up on the user’s screen. I attached a screen capture showing what was observed while initiating the session with a single high resolution display detected and one with multiple displays detected. observed remote app login The important thing to note here is that this does NOT affect the look of the actual application when it appears in RemoteApp mode and it does not affect the ability to launch the application itself. This is purely a cosmetic concern. I have three questions on this: Is this this due to the configuration of the Remote App session? Is this the result of a limitation of FreeRDP? What would b

160
T
BeyondTrust Employee
T
TimNewcomer
posted in General
We run RDS farms for PSCloud on premises - what would you use in AWS?

Hi All, We expect to close our on premises DC’s in the coming years, and we currently run a traditional RDS farm with F5’s in front to enable the non-SSH/RDP workloads managed by PasswordSafe Cloud… Microsoft RDS licensing options in AWS (AWS is the only answer for us - please don’t suggest Azure!) are very limited and the equivalent would be significantly more costly than the current level. For other internal systems, we’re looking at AppStream2 - has anyone looked at this or other options for PasswordSafe Cloud or are we locked to RDS and the associated costs? Trying to gauge what the community is doing and what experience, if any, is out there 😀 Many thanks in advance Tim

120
T
R
Robert A.Rising Star
asked in General
Securing default generic accounts (bt/bi/bu-admin)

Hi, I’m trying to find a good way to secure these generic accounts and still to be able to use them as bt- and buadmin are used on a regular basis for updates and support cases. As I have 4 appliances to manage and have high security requirements I’d need to have individual passwords, with regular changes and changes after access for each of them. It would be a challenge to manage the regular changes and make performing regular tasks challenging. I had posted an idea to use the Enterprise Updater as SPOC (Single Point of Control) which would have it’s own credentials and would have an encrypted key based connection to all appliances. From the Updater one could create individual schedules for the updates and unlock/lock them centrally. This would make tracking, planning and handling of updates a lot easier and only one generic user (buadmin) would need to be secured. I’d prefer a personal account though and leaving the generic account as a breaking glas solution. This would only cover t

866
R
B
BartoszApprentice
posted in General
Additional TOTP step for federated authentication

Hi all, I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Additional TOTP step for federated | All Product Ideas - Public it’s not possible to use TOTP when federated authentication to Password Safe is enabled. Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful. Cheers, Bartosz

685
rhagerm
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 14 - Apr 21)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021352 - Secrets Safe import secrets menu option missing KB0022203 - User in admin group is not able to see "view all safes" toggle in Secrets Safe KB0022204 - Cannot view discovery reports "An error was reported" KB0022217 - Secrets Cache install fails with error "0x80070643 - Fatal error during installation" KB0022218 - End user does not have personal folder in Secrets Safe

70
GloriaB
BeyondTrust Employee
S
suhail.salimNewcomer
asked in General
Change AD user status from active to inactive/disabled

Hi All, We have AD users in password safe who are quarantined and form login disabled. The users are no longer in organizations. The group we created to onboard these users are also disabled/deleted. The access revoke method used by earlier admins were incorrect and they removed the group from password before syncing them. Is there a way we can make these users status as inactive?

262
MikeK
D
Didla DheerajNewcomer
asked in General
Enhance the disco scans so they don't generate the false-positive logon events

Hi All, When the Password Safe Detailed Discovery Scan runs against a Windows server, the BTExecService agent deployed on the scanned server enumerates the members of all local admin groups, so these can eventually be onboarded and managed by Password Safe. We have observed that Group Memberships for each enumerated account are also checked. This enumeration process is causing the LastLogonTimeStamp for the enumerated accounts to be updated, generating logon events attributed to the Discovery Scan agent BTExecExt.Phoenix.exe, even though no actual logon operation took place. In fact, according to the Microsoft article below, the LastLogonTimeStamp attribute can be updated and trigger a logon event even if the user has not logged on. This behaviour is an artifact of a Kerberos operation known as Service-for-User-to-Self (S4u2Self), in which a client/service can request a ticket for a user that is only useful for things like determining Access Checks or Group Membership. https://techcomm

371
H
BeyondTrust Employee
D
Didla DheerajNewcomer
asked in General
Native web application support in PAM

Hi All, Currently it's not possible to add a webbrowser application native in BeyondInsight Password Safe and inject the privileged/managed account credentials, without RDP/RDS server integration. Please add the option to: Add a (web)application page and inject the privileged/managed account credentials Add a rotate option, using an API functional account with custom API scripting/calls. Best regards, Dheeraj.

381
H
BeyondTrust Employee
T
tsipesNewcomer
asked in General
API /Secrets-Safe/Secrets returns no data

We recently upgrade to 24.3 and now we have a reporting issue. Using the API /Secrets-Safe/Secrets with a GET returned all the secrets stored. Now, it returns nothing. Other API calls to other endpoints work with no problem. This is a SOX reporting issue now. I have opened a ticket but thought I would try here to see if anyone had any thoughts. Other than the software upgrade, nothing else has changed. TIA

211
H
BeyondTrust Employee
S
SathishNewcomer
asked in General
how to setup email notifications to the service account owners once the password is rotated in password safe

We have the following use case: Onboard the service account to password safe Notify the service account owners with the new password when the password is rotated in password safe. The password need to be communicated to the service account owners for any external service account usage beyond password safe The service account password should be updated by the password safe on the underlying windows services/scheduled tasks/ IIS application pools. I would like to understand the feasibility on the email notifications, password updates on the services and any challenges that anyone faced while onboarding the service accounts.

451
H
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (Apr 7 - Apr 14)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021854 - BeyondTrust Product Update Server changing from Imperva to CloudFlare KB0022146 - Not receiving reports from the Analytics and Reporting tool - No records were found matching your criteria KB0022192 - Appliance logs not downloading - timeout error "The request was canceled due to the configured HttpClient.Timeout of 100 seconds elapsing" KB0022199 - How to upgrade Secrets Cache for Windows KB0022211 - Resource Broker update fails "Setup Wizard ended prematurely because of an error"

180
GloriaB
BeyondTrust Employee
P
prasadp87Trailblazer
asked in General
Bulk Functional account changes

Hello Team, We have around 500+ Managed Systems, and we want to change their functional account in bulk. Can someone please suggest best possible way to do this? Note: The functional account remains same for all. Thanks, Prasad

181
R
J
BeyondTrust Employee
Johnli AzucenaBeyondTrust Employee
posted in General
Password Safe: Discovering and Adding Assets Interactive Workshop 

Hop on and join our interactive workshop, where you can gain hands-on experience and handle different use case scenarios. TITLE: Password Safe: Discovering and Adding Assets Interactive Workshop Date: 28 May 2025 Time: 8 am Eastern and 1 pm UK and 8 pm SGT Duration: 90 minutes Workshop Aim: This interactive workshop enables participants to learn the aim and process of adding Assets into BeyondInsight. There will be an opportunity to troubleshoot and configure Discovery Scanning for different Use Cases, configure these within a virtual test environment and collaborate with other contributors. Learning Objective: Learn how to create and configure Discovery Scanning in Password Safe and apply them to specific use cases In this session we will cover: Known Assets and Managed Assets Adding an Asset into BeyondInsight manually Configuring a Detailed Discovery Scan Discovering and Scanning an Asset from a Directory Scheduling a Scan by Address Group Discovery Scanning Use Case Configuration C

300
J
BeyondTrust Employee
J
BeyondTrust Employee
Johnli AzucenaBeyondTrust Employee
posted in General
Password Safe: Access Policies Interactive Workshop

TITLE: Password Safe: Access Policies Interactive Workshop Date: 29 April 2025 Time: 3 am Eastern and 8 am UK and 3 pm SGT Duration: 90 minutes Workshop Aim: This interactive workshop enables participants to learn the aim and process of configuring and scheduling Access Policies in Password Safe. There will be an opportunity to troubleshoot and configure Access Policies for different Use Cases, configure these within a virtual test environment and collaborate with other contributors. Learning Objective: Learn how to create, configure and schedule Access Policies in Password Safe and apply them to specific use cases In this session we will cover: Introduction to Access Policies Access Policy Types Configuring and Scheduling an Access Policy Connection Profiles Access Policy Use Case Configuration Click here to enroll! For more information on workshops or to make suggestions, please navigate here.

290
J
BeyondTrust Employee
D
DerianVNewcomer
posted in General
Ability to upload our private CA certificate or to be able to turn off the certificate verification in the UI.

Hi all, I’m wondering if we’re the only ones who’s struggling with this problem, as you can find in already raised idea Ability to upload our private CA certificate or to be able to turn off the certificate verification in the UI. Sometimes if a CA certificate it’s not working, we need to rebuild the certificate instead of being able to only turn off the certificate verification option for SIEM integration (QRADAR) for example. Do you have similar situation by any chance? You can share your experience or vote for an idea if you find it useful. Cheers, DerianV

411
tclowater
BeyondTrust Employee
J
JayaNewcomer
posted in General
More Description Error message when RDP fails

Hello Everyone, I wanted to bring up this issue with RDP Failure error messages in PBPS. Currently, when an RDP session fails, users see a generic message like “Failed to connect RDP session” without any specific details on the reason- whether it’s an account lockout, network issue or authentication failure. Pbsm.log contains more detailed error codes, it would be great if these codes are translated into more meaningful messages within the UI, it would significantly reduce troubleshooting time. We have an idea for same raised: More Description Error message when RDP | All Product Ideas - Public Would love to hear if anyone else have encountered same challenges? You can share your experience or vote for an idea if you find it useful. Cheers Thanks and regards Jaya

491
tclowater
BeyondTrust Employee
V
VarunsUni29Apprentice
asked in General
Onboard TOTP Seed File to generate OTP Code in Password Safe

Dear Team, The client has a use case to upload TOTP seed file and generate the new OTP on the console [similar to the retrieve password option]. For example, BeyondTrust Password Safe acts like Google/Microsoft authenticator app. I can't find any platform to upload the seed file, which will generate the OTP as output. Anyone who implemented such use case before? This kind of usecase is already available in BitWarden. Please find the link below: Viewing TOTP Code: https://bitwarden.com/help/integrated-authenticator/ Thanks in advance!!Varun

621
tclowater
BeyondTrust Employee

Most helpful members this week

Badge Earners

  • BCSE: Privileged Remote Access
    jreeveshas earned the badge BCSE: Privileged Remote Access
  • BCA: Password Safe
    alessio.marottahas earned the badge BCA: Password Safe
  • BCSE: Password Safe
    AmilaKhas earned the badge BCSE: Password Safe
  • BCA: Password Safe
    Tony Forsterhas earned the badge BCA: Password Safe
  • BCIE: Endpoint Privilege Management - Windows
    Angelahas earned the badge BCIE: Endpoint Privilege Management - Windows
Show all badges

Popular tags

Terms & ConditionsCookie settings

Cookies

By clicking “Accept Cookies”, you agree to the storing of cookies on your device to enhance and personalize your experience. Learn more about our cookies.

 
Cookie settings