General

We implemented Password Safe for our dedicated domain admin accounts in May/2024. At the time, we experienced some frequent lockout issues with these accounts, but nothing that couldn’t be explained or resolved by simple process changes for users (i.e. forgetting to sign out of systems before the password release expires). In Sept/2024, we saw an uptick in lockout frequency with these accounts that couldn’t be explained. Most of the lockout events occurred on the Windows machines users were in possession of rather than from accessing a remote VM like we saw in the past, (aside from some of our support staff who encountered lockouts from end user machines they had previously worked with and used their credentials to establish a remote support session via Teamviewer). Lockouts occur multiple times a day regardless of a reboot on the problem device. No processes are found running with dedicated admin account on the machine, yet ongoing lockout events on the account continue to register fr

Hi all,Environment:BeyondInsight / Password Safe on-premises, U-Series Appliance, version[26.3.x – confirm build] Deployment:[ Active-Passive HA ] Managed servers: Windows and Linux, spread across multiple VLANs RDP/SSH sessions go through the Password Safe session proxy, with recording and Change Password After Release enabledOur challenge: Admins can still bypass Password Safe and connect to servers directly with mstsc.exe or PuTTY. Those sessions aren't requested, approved or recorded. Our current setup:GPO adds regular accounts to local Administrators. Restricted Groups / GPP add domain groups containing admins' regular (non-privileged) accounts to the local Administrators group on servers. Servers are spread across multiple VLANs. Admin workstation VLANs can route to server VLANs, and inter-VLAN rules allow TCP 3389/22. Default RDP logon rights. Any member of local Administrators can log on through Remote Desktop.Questions:Does BeyondTrust have an official recommendation or harden

 Hi AllI have one requirement to change password of managed account on HPE Storceonce device. This devices supports password change only using Rest APIs. I know we can create custom plugin and from there we call APIs for password rotation. I wanted to understand if there is any other way , where in we can call Powershell script. This script I can write that can hit API and rotate password. Please let me if know if any solution is present.Regards,Imran Aliyani  

Password Safe on-prem: if an Access Policy has Approvers = 3, must all 3 approvers approve before access is granted? Is sequential (multi-level) approval supported?

Hello All, I was referring this KBA article -Knowledge Article - Customer Support (KB0016945)In this its explained about the column ‘Mapped to User’. Do we know how this mapping is established. Is it something in Smart rule which helps in setting this mapping. Thanks,Prasad  

Hi there, currently i got some case request for one of my customers, their using 3 UVM 2016 in A/A deployment with BI version 25.1. they want to upgrade UVM 2016 to UVM 2022. is there any one that experiencing this upgrade scenario before ? because , i just planning  to add on new UVM 2022 as worker node first before enable the new UVM 2022 as an admin console before all UVM 2016 will be take down and dismantled. Thanks, and hope you are all have a great day a head.

I am facing an issue while launching PS_Automate through CMD.Initially, there was no issue when I tested it with the default BIWebApp.ini file. However, after making a copy of the same file and renaming it to WAF.ini, I started receiving the following error when trying to launch PS_Automate:Error: Subscript used on non-accessible variable.My BeyondInsight/Password Safe version is 26.2.Could anyone please guide me on what might be causing this issue and how I can troubleshoot or resolve it? 

Has anybody here ever implemented Qualys scanning against their PS on-premises appliances? Is it possible to create a local account for Qualys on our on-prem appliances for Qualys scanning or is this not allowed?

Hello Beekeepers community!!!We currently add Active Directory (AD) users to local BT Group security groups for access management. However, we have identified a concern regarding user lifecycle management and audit compliance.At present, when a user account is disabled or becomes inactive in Active Directory, the user is not automatically removed from the local group(s) to which access was previously granted. As a result, the group membership does not accurately reflect the list of active users.For example:Local group: BT-PAM-ACCESS Total members displayed: 10 users Actual active users: 8 users Disabled users in AD: 2 usersEven though the 2 users are disabled in Active Directory, they continue to appear as members of the local group. During audits, we provide screenshots of the local group membership as evidence of access reviews. This results in audit evidence showing all 10 users, which can be misleading because it includes accounts that are no longer active.Concern: The current proc

Hey all, I’m looking to optimize how we use BeyondInsight/Password Safe Managed Account Propagation Settings and would love to get your input. Right now, we want to automate password rotations for our domain service accounts without accidentally breaking dependencies like Windows Services, Scheduled Tasks, or IIS App Pools. I’m curious to know exactly how the propagation engine behaves under the hood in your environments?What specific use cases you’re leveraging it for and most importantly, what configurations or operational habits you’ve put in place to ensure 100% consistent results without missing target servers or causing service downtime. So, how are you guys handling this successfully?

Is there any way to change IP address of already onboarded assets to Beyondtrust password safe? everytime we have to delete the older asset and then re-onboard the asset.

In BeyondTrust Password Safe, Cloud  why are some manually added assets unable to change the assigned workgroup? The option appears unavailable & disabled.  

Hi all,Just want to check, does anyone have the official slide deck for the BeyondTrust Password Safe solution from BeyondTrust?Thanks.

I have created a daily backup for my PS using Windows File shares and was pointed to one of my Windows File Share using a domain service account. This one works fine. My only concern is that we keep receiving alerts about NTLM login failure/SMB session failure for the service account since it was running from the U-series appliance (non-domain joined) and connecting to the windows file share in the domain using the domain service account. Even though the daily alerts keep popping up with those failures, we still have the completed backups. I was wondering if you guys have any better option with this backup and minimize these kinds of alerts?

How to export Secret Safe from 24.X On prem to 26.1 Cloud?I m able to export the folder names, secret names but not keys, credentials and files. how can we do this in bulk.

A few times I’m asked about what to do about employees who have left the organization and their accounts that are in PasswordSafe. The following are some suggestions on next steps, and components to watch out for when cleaning up the environment. Step 1: Audit Current Access in PasswordSafe I would recommend running this before deprovisioning a user so you have a record of their configurations to make clean-up activities a bit easier. Unless the user is an Admin - skip to step 2. Step 2: Remove Access to PasswordSafe 🚩 Note: if you have let go an Administrator, validate PasswordSafe immediately, regardless if automation is configured, to ensure there are no potential paths into the vault by removing access to PasswordSafe. While this may be the most obvious, there may be a few components worth noting. Occasionally this may be set up with a SCIM, or integrated into an automation for user lifecycle management. The short version is to ensure the users aren’t provisioned to a group that p

We need to onboard Linux systems that use a graphical interface, such as GNOME. What options do I have to do this so that I can also record sessions, just like with RDP? It must also be supported by BT.Regards Arno 

We have multiple Password Safe appliances behind load balancer. Appliances are not directly accessible, users must use load balancer.When user receives a forgot password email, it contains a password reset link with appliance hostname instead of load balancer address. Please advise what configuration change is needed, for password reset email to have an URL with load balancer address instead of appliance local hostname.

I have strange behavior in my PasswordSafe.I am using an application session, and when I try to start an RDP Session / Start Application Session: When using the option to run on a different system with the functional account, it works perfectly. When using the option to run on the current system with the user account, the RDP session does not start. It shows a black screen for some time and then closes. When I checked the logs in the second case, I found the following: INFO: Accepted RDP session 1234 for 1.2.3.4:1234 INFO: RDP Handler 1234 starting INFO: Found RDP certificate: My:.... INFO: Reading self signed cert INFO: (RDP server) Client Security: NLA:1 TLS:1 RDP:0 INFO: (RDP server) Negotiated Security: NLA:0 TLS:1 RDP:0 INFO: (RDP server) Server Security: NLA:0 TLS:1 RDP:0 ERROR: (RDP server) BIO_read returned a system error 0: No error ERROR: (RDP server) transport_read_layer:freerdp_set_last_error_ex ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D] ERROR: (RDP) BIO_should_retr

Hi guys,I just want to clarify how the asset-based licensing works in Password Safe.For example, if we have 50 asset-based licenses and all 50 licenses are currently being used, but the client wants to onboard one additional asset/managed system, we would need an additional license.My question is: If we decommission/delete one of the existing licensed assets/managed systems, will that license be released and become available so that we can onboard the new asset/managed system using the same license?In other words, can a license be reused after removing an existing managed system, or would we still need to purchase an additional license for the new system?Could someone please clarify how Password Safe handles this scenario?Thanks.

OutlineWhy this comes up The idea in one paragraph Why an attribute and not something else A starting vocabulary Why decommission needs two states Building it Things that will bite you Pre-staging, which is the fun part An import connector is not a substitute for this Additional ResourcesWhy this comes upI’m often having the same conversation when I show users the Dashboards → PasswordSafe and the failed password changes. A server gets decommissioned somewhere upstream, or a directory account is decommissioned, but nothing tells PasswordSafe of this change; often it’s an object that no longer matches the Smart Rule query for onboarding. Then I come along asking someone to investigate their password test failure report trying to work out whether a box is broken, gone, or was never finished being built in the first place. Multiply that by a few thousand systems, and managed accounts, and then the rotation failure report stops being a signal and starts being wallpaper. 🫠Most PasswordSafe

We have a case where users connecting to VPN from outside the country get a specific pool/subnet of IPs when successfully connected to VPN. Now we have a case, that such users should not be able to access certain Assets/IPs. Can we have any kind of control for this. PAM can check what is the source IP and then do not allow access to restricted assets. Is this doable?

Hi All,I need to test the functional account test on multiple system. Systems are more than 500 and all systems are non domain joined. I need to test password and create the report. Post that I will work with respective team to get it sorted. However currently testing one one system it is very difficult.I want to understand how can I do testing of functional account in bulk Is there any API available to do functional testing in bulk.I need help here please to understand how can I resolve this issue ?Regards,Immi