Skip to main content

General

A general place for Password Safe conversations.

  • 225 Topics
  • 543 Replies
225 Topics
B
Community Manager
BeyondTrust CommunicationsCommunity Manager
published in General
Monthly Buzz - May - Password Safe

Azure Key Vault - Password Safe Custom Plugin While there is a Platform Plugin for Azure AD /Entra ID out-of-the-box, it is used for managing Entra ID Users passwords.  We have seen demand over the years for the capability to manage Azure Key Vault credentials. The Plugin covered in this guide includes support for managing Secrets.  Capabilities  Change Managed Account Credentials using Functional Account Change Functional Account Credentials Verify Managed Account Credentials Verify Functional Account Credentials Discover Accounts The Password Safe Resource Kit includes a SDK for developing Custom Plugins. The SDK comes with a Sample Plugin example, which has been used to create this Custom Plugin example to allow for the rotation of Secrets in Azure Key Vault. Read more here Latest Available Version:Password Safe 24.3– December 2024 Beekeepers Hot Topics PasswordSafe/ WebConsole login  “Hi Team,I have a query regarding web console login: "Can we use the same user account for

80
B
Community Manager
A
Avishka VithanageNewcomer
asked in General
CISCO 'Enable' Password Management

We have a requirement to onboard Cisco devices into Password Safe. For privilege escalation, we need to use the 'enable' secret. The non-privileged user account and the enable secret use separate passwords.Is there a way to manage this scenario in Password Safe?

50
A
N
naveen_muduNewcomer
asked in General
Linking of Assets, Accounts & applications

I have a use case where we are using the domain accounts for accessing Network devices and windows. Say abc.domain@domain.com which is linked to a network device, Windows and an application. Similarly abc2.domain@domain.com, abc3.domain@domain.com. Linked with all the Network device, windows and application.I have done the linking of the managed accounts to systems (Network device, windows and application.)I have configured in the managed account smart rule mentioned that Managed account field=abc.domain@domain.com & Asset smart group= Windows. in the condition i have given the show managed account as smart group. Also mapped the user group to this smart group.We have also got applications which are running with the same account abc.domain@domain.com. applications are in Windows, network devices.We are able to see in the directory linked accounts it is showing only windows which is as expected and the account abc.domain@domain.com. But when seeing in the applications it is showing

231
J
BeyondTrust Employee
M
mcencienzoRising Star
asked in General
Difference between Scheduled Password Change and Force Change Password

Hi, Does anyone encountered scheduled password change fails due to permission denied error however if you use force change password, it successfully changed the password? The system is Ubuntu and I wonder, what’s the difference between those 2 functionality. The account settings option for the Ubuntu managed account is configured to use a functional account when changing password and Use Own Credential is disabled. If I try to simulate the changing of password on the server, the passwd <managed account> command doesn’t work due to an error showing “passwd: You may not view or modify password information for <managed account>”. If I run the command, sudo passwd <managed account>, it requires us to input the sudo password. With this two commands unable to work properly, I wonder why the force change password works? Any idea?  Cheers~!

231
J
BeyondTrust Employee
K
kimberlyvApprentice
asked in General
Password Safe Propogation Actions: IIS Management Service Delegation

Hello, do you know if there is anything in the works to have managed account credentials also be updated in IIS > Management Service Delegation? 

91
jacek.krecisz
B
bpkothariApprentice
asked in General
Comparison between Privileged Identity and Password Safe

Need Comparison between Privileged Identity and Password Safe (including features, scalability, audit, troubleshooting, integration, APIs, architecture, User Interface etc etc? Is there any refernce document available to higlight why its a better than PI to management?

141
H
BeyondTrust Employee
S
SathishNewcomer
asked in General
how to setup email notifications to the service account owners once the password is rotated in password safe

We have the following use case:  Onboard the service account to password safeNotify the service account owners with the new password when the password is rotated in password safe. The password need to be communicated to the service account owners for any external service account usage beyond password safe  The service account password should be updated by the password safe on the underlying windows services/scheduled tasks/ IIS application pools.I would like to understand the feasibility on the email notifications, password updates on the services and any challenges that anyone faced while onboarding the service accounts. 

1023
H
BeyondTrust Employee
T
tmontagueNewcomer
asked in General
System Event viewer filled with warnings. What do these even mean?

I’ve noticed lately that our system event viewer in is filled with warnings.  Most of them are complete gibberish to me.  Most are like this but with different IDs: CPP: Postpone CQ item due to active Release Request Id:(3753), Expiration time: 5/29/2025 10:33:17 PM UTC - ChangeQueue: id=18576, MAid=663, FAid=, MSid=5, SubDt=2025-05-29 13:33:07 UTC, ChgDt=2025-05-29 13:33:07 UTC, Reason=R, ProcStartDt= UTC, NumFail=, RelID=, ReqID=3751, RemoteCl=false, OWA= These come in sometimes multiple times a minute.  Just for the last 15 minutes, there are 130 of these. There are over 5000 in the past 24 hours.  What is this trying to tell me?

101
MikeK
K
kimberlyvApprentice
asked in General
Secret Safe API 404 Error when using Python script

Hello,We are using the secret safe api to pull secrets and plug them into our applications. When testing our script in  PowerShell it works, however, in Python, we are seeing a 404 error. Any idea? Our RunAs user is a domain account. TIA!

314
K
A
Avishka VithanageNewcomer
asked in General
Customer having issue that functional account saves files when user download files in remote app sessions

If a shared functional account is used to log into the application server (RDS), users can see files downloaded by others in the Downloads folder from previous sessions. Is there a way to prevent this behavior?

141
MikeK
A
AnilreddyApprentice
asked in General
From On prem to password safe cloud migration

HI All, Good dayDo you have any document/article to migrate from on-prem to password safe cloud. Thanks and looking for your response

524
H
BeyondTrust Employee
R
rgkesselApprentice
asked in General
Lagging RDP session - Windows 11

Hello all, We are experiencing a behavior with RDP sessions via Password Safe initiated from machines with Windows 11.The session has a slow image loading, appearing to load in rows of images and in blocks.A simple movement of windows within the RDP session causes the image loading of this movement to be very slow.This does not occur if the RDP session is direct with the destination server.But if the connection is through Password Safe being Windows 11 > Resource Broker > Destination server, this slowness is noticed. Has anyone else noticed this problem in your environments? Additionally, this behavior does not occur in Windows 10.Points that I have already checked:- The software installed on the computers are the same between Windows 10 and 11;- The network settings are the same. This behavior occurs on both wireless and wired networks;- The GPOs of the Windows 10/11 stations, Resource Brokers and destination servers have already been checked. No Remote Desktop configurations th

12710
I
P
prasadp87Trailblazer
posted in General
U-Series Appliance login credentials

Hello All,We have an existing setup of Beyond Trust u-Series appliances. When we try to access the U-Series appliance portal page, the page is visible requiring username and password. Unfortunately, we have lost the credentials. Is there anyway by which I can get the lost admin credentials back. Please suggest.Thanks,Prasad

202
P
S
SFARising Star
asked in General
RDS Server Hardening and browser hardening when PAM launches session via RDS server

Hello TeamThe application session launched via the RDS server allows users to access files placed in the RDS server desktop etc, if we launch the web browser and do ctrl + o . and then navigate.We can also launch cmd and powershell etc. What are recommended hardening for applying segregated access within the application sessions launched via the RDS server as its one single user profile being used for the RDS sessions.

4747
A
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (May 19 - May 26)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0022151 - Is SQL always on required for Active Active environments? KB0022305 - BTUpdater service keeps crashing after update to 3.4.2.1876 KB0022381 - Scan account on Linux Sytems not finding local accounts KB0022405 - Password Safe Cloud Notification - Failed to queue update for resource broker KB0022431 - When the user goes to share the secret, they do not see or get the option to select which safe to add it to. KB0022443 - U-Series appliance performance metrics KB0022451 - Is it possible to extend the C drive of the U-Series appliance?

70
GloriaB
BeyondTrust Employee
C
Cygnus-x1Rising Star
asked in General
Smart Rules Examples

Hi,I am new to BeyondTrust.Can I find some Smart Rule examples with explanation?Thanks.

3294
GloriaB
BeyondTrust Employee
S
ScottBRising Star
asked in General
Dedicated account mapping - local accounts

Investigating a requirement to map std user accounts in Password Safe to a dedicated local account (unix in this case) BUT with the same name/format. Unix accounts do NOT have any prefix/suffix additional to their Entra/AD login to PWS account.As a Unix local account, cannot use any account attribute mapping either.The onboarding Smart Rules is ok - we can utilise the regex capability (x characters, y numerics format).It’s the mapping Smart Rule were we have the issue, as this doesn’t provide regex option, mainly suffix/prefix.Any thoughts people?

211
Paulo144
C
Cygnus-x1Rising Star
asked in General
Onboard GCP IAP Application

Hi, We need to onboard GCP IAP application in Password Safe.Would appreciate any help/guidance on automating the login process.Thanks 

111
tclowater
BeyondTrust Employee
T
TimNewcomer
posted in General
We run RDS farms for PSCloud on premises - what would you use in AWS?

Hi All, We expect to close our on premises DC’s in the coming years, and we currently run a traditional RDS farm with F5’s in front to enable the non-SSH/RDP workloads managed by PasswordSafe Cloud…Microsoft RDS licensing options in AWS (AWS is the only answer for us - please don’t suggest Azure!) are very limited and the equivalent would be significantly more costly than the current level. For other internal systems, we’re looking at AppStream2 - has anyone looked at this or other options for PasswordSafe Cloud or are we locked to RDS and the associated costs?Trying to gauge what the community is doing and what experience, if any, is out there 😀 Many thanks in advanceTim

321
tclowater
BeyondTrust Employee
M
maulik shahRising Star
asked in General
Disabled at Rest works and cloud access

Hello Beekeepers  , I am working on one integration project where i need to give access to password of managed account to users, We will be using disable at rest future to make it true on demand / JIT .  Problem comes in sync, if we leave all default replication to cloud and local it takes about an hour time. i am just wondering does beyond trust has any integration point which can be force ad replication or in cloud ad replication when such a password extracted. 

201
H
BeyondTrust Employee
K
kimberlyvApprentice
asked in General
API Endpoints

When API endpoints are changed, how often will this be? With the last big update BI had, some endpoints were depracated. I am curious how often this is going to happen? APIs have become very popular in our environment and alot of our scripts are breaking with these changes. Ex.) In BeyondInsight/Password Safe 24.3, "UserGroupId" has been deprecated.I know the word “Safe” was also replaced with “Folder”. 

531
M
BeyondTrust Employee
N
naidu_jstsTrailblazer
asked in General
Session should be enabled by default in BT passwordsafe

How to ensure that even Admin session should be recorded. There should not be an option to avoid Recording.

735
MikeK
vikas5611
vikas5611Newcomer
asked in General
How to Onboard Oracle internet directory in Password Safe

Dear Team,I am currently configuring Oracle Internet Directories (OID) to integrate Oracle database systems with Password Safe.The provided BT documentation outlines the steps to configure an OID and add Oracle databases as Managed Systems in Password Safe. However, the documentation does not explain how accounts are discovered automatically if we do not perform a scan.https://docs.beyondtrust.com/bips/docs/ps-add-dbSteps Followed:Navigated to Configuration > Privileged Access Management > Oracle Internet Directories.Clicked on "Create New Oracle Internet Directory +".Entered the name, description, and LDAP server information. Checked "Use SSL" as desired.Turned off "Use Anonymous" and entered the name and password.Clicked "Create Directory" and tested the server connection.Issue: The documentation does not provide information on how accounts are automatically discovered without performing a scan. I need guidance on how to ensure that accounts are discovered and managed correctly

191
C
BeyondTrust Employee
K
KbeeNewcomer
asked in General
Password History - minimum numbers versus days.

Hi all,Hoping to confirm how these two values in Password Safe global policy (“Minimum (days) retention for old password” and “Number of old passwords to retain”) operate when one value has been reached but not the other.Eg, if "Number of old passwords to retain" is set to 5 and minimum retention in days is set to 30:-Observation and some doco suggests that if a password is only changed once a month, password history will be kept for 150 days (despite the 30 day retention period) - assumedly delaying purging to allow the minimum of 5 old passwords to be retained.Does this apply in the reverse? Ie, with the same settings, if a password is changed daily, will Password Safe retain 30 old passwords so as to satisfy the 30 day minimum retention?Can anyone confirm?Thanks!

201
N
BeyondTrust Employee
GloriaB
BeyondTrust Employee
GloriaBBeyondTrust Employee
published in General
BeyondInsight / Password Safe - Knowledge Article Publications (May 12 - May 19)Weekly KB Publications

The following articles were published last week. New Knowledge Base Articles: KB0021884 - BeyondInsight Password Safe Licensing FAQs KB0022279 - On the Password Safe dashboard slowest Smart Rules are not shown KB0022327 - How long are session recordings saved for in Password Safe Cloud? Is it configurable? KB0022329 - Where is the maintenance page for Password Safe Cloud implementations? KB0022330 - Can session archive be configured for Password Safe Cloud? KB0022333 - Can SMTP or NTP solutions be integrated in Password Safe Cloud? KB0022334 - What is the concurrency limit for Password Safe Cloud? KB0022357 - Error when using API to create secret - 404 or 400 Bad Request KB0022359 - Unable to save date or time on physical or Hyper-V U-Series Appliance - Date and time settings were not saved successfully. KB0022382 - Can a list of IP addresses for an address group

80
GloriaB
BeyondTrust Employee

Badge Earners

  • BCSE: Identity Security Insights
    CDashhas earned the badge BCSE: Identity Security Insights
  • BCA: Password Safe
    Martin_Acostahas earned the badge BCA: Password Safe
  • BCA: Endpoint Privilege Management - Mac
    jchewhas earned the badge BCA: Endpoint Privilege Management - Mac
  • BCA: AD Bridge
    safaey.atefhas earned the badge BCA: AD Bridge
  • BCIE: Privileged Remote Access
    Enrique-Corehas earned the badge BCIE: Privileged Remote Access
Show all badges
Terms & ConditionsCookie settings