General

I have a windows 2019 server enabled with RDS services and password safe for users that need to have privileged access to cloud apps that are onboarded as enterprise apps in Entra / Azure. How can i give users a single on sign experience when they do not have access to the account password? I am trying to avoid published apps and keep my admin overheads as low as possible.Has any here been able to make this happen? I had something running to support this when we had ADFS, but sadly we have moved on.

Anyone has setup RDCMAN tool ( the microsoft remote desktop manager tool) for multiple servers via script or csv? We have 1000 servers to configure, any way to do automate the import or the connection string configurations?

Hi everyone, hope y’all having a great holiday season so far! We’ve been reading non stop KB0017007 and could not get to work the LDAPs with the rotation of accounts. All of this was detected by a customer that captured the traffic between Password Safe and their AD and saw the credentials when the appliance rotated the passwords. We tried every extention of Certificates (PBX,Cert,etc) and nothing could seem to work, so I come forward asking for some experience from everyone. Best practices say the UVM should not not be added to the AD (due to possbile GPO issues and other), and the customer uses a “*.customer.com” (wildcard) certificate for their whole roster of Servers, dont know how that pans out here. Ports are ok, so far. So, connectivity issues are the least t

Were do you go to see the Password Safe UVM Appliance/ Beyond Insight total uptime

2 of our 5 appliances are locking my AD account. The lockouts of my ad account are coming from these two serversthese appliances are not domain joined.The only time I use my ad account on these servers is:to log into the web UI. to map network drives to move files on and off.This started back in April and wound up turning them off. turned them back on a week and a half ago and deleted the btadmin profile and that seemed to clear up the problem. then earlier this week I had to map a network drive to get files on and off the appliance and it started happening again. when I map the drives I do not save my password nor do I set it to reconnect on login but something on the appliances is locking my account out.we have checked the credential manager and there are no passwords there. we have checked the net use command and there are no persistent mappings. we have searched through the registry and there are no en

Per release notes for 24.2.1, the BeyondInsight Analysis feature is planned to be removed on the next release. The logic behind removing this feature is that this report is akin to the Windows event logs; it contains a lot of details that can be confusing to lesser experienced PAM administrators. This has led to support cases for BT and I don’t blame them for wanting to depreciate this. However, if you have an on-premise Password Safe environment with more than a few UVM’s, this tool can be very valuable if you want to get a quick glimpse of your entire environment vs. having to go to each UVM/Worker node to gather information.I have created an “Aha!” idea (Analyzer Results (Please Don't Remove | All Product Ideas - Public) asking that this be reconsidered.Does anyone else find this tool useful? If so, check out the idea link above and

The following articles were published last week. New Knowledge Base Articles: KB0021659 - Configuring SAML login with multiple domains in BeyondInsight Password Safe receiving "An error has occurred Oops! Something went wrong! KB0021674 - Unable to change Entra ID Managed Account's password - Error Details shows Index and Length must refer to a location within the string

This is a suggestion for a smart rule feature. When a linking smart rule (for managed systems) is linked to a directory domain account (managed account), if a managed account is manually removed from the systems assigned to it by the linking smart rule, the systems are added back to the managed account when the linking smart rule processes. Can we have a feature that allows Password Safe to exclude any managed accounts that have been manually removed from the linking rule when it processed?

Hey Guys,I have got a use case where my client does not have a centralise PAM team to control end to end asset/accounts onboarding to Password Safe (PS) and manage the BT upgrade. I can think of a solution as BT tool related tasks (patching/upgrading etc.) can be taken by Infra/ IT team and 1 person from each application team (Linux, Windows, Database etc.) can be given permission to perform a set of actions like onboard asset/account, manually trigger update/change password, approve request etc.Application Team owners will be provided with End User Guide explaining each task they can perform so they have all the resources they need.I see there is ISA role which I can leverage for Application Owners but it gives a lot of unwanted permission.Is there any other way where I can create another role in BeyondTrust Password Safe to cater my specifics?Thanks in advance!   :)Disclaimer: I have worked in other PAM tools where

Hi,I have a lot of customer who needs Secret Safe + Workforce Password features for all their users to be able to provide a central password storage system. However the licensing model around Secret Safe is crazy because they have to buy a full Password Safe license, just to be able to use Secret Safe module…. and moreover they have to buy a new license just for WFP ! I would like to understand why Secret Safe is not bind as WPF on end user licensing ??? Please provide us more flexibility on this because we are loosing projects :-/

The following articles were published last week. New Knowledge Base Articles: KB0021014 - Password Safe Secrets Cache for Linux step-by-step for configuring, testing and troubleshooting KB0021192 - Password Safe Secrets Cache error "Key not valid for use in specified state" KB0021412 - How to manually configure SSH host keys to make fingerprints consistent

Hello,We have a standalone updater server. It was supposed to download all the subscriptions packages and the 2 UVMs connect to the updater server to get the packages and installed. We actually did the Windows update back on February 2024. However, when we tried to update the appliances to windows security update to 202409, we couldn’t find the subscriptions on the available list. The screenshot was below: The updater server has full Internet access and test connection was success.Below is part of the updaterService log:2024-10-16 11:20:00,152 [15] INFO PackageManager - GetDownloadablePackages()2024-10-16 11:20:00,152 [15] INFO PackageManager - Get subscriptions.2024-10-16 11:20:00,152 [15] INFO A. - GetSubscribedSubscriptions2024-10-16 11:20:00,152 [15] DEBUG PackageDownloadInter

Hi Beekeepers, Any idea on limit on concurrent session via password safe console maximum limit.

The following articles were published last week. New Knowledge Base Articles: KB0021671 - Report Subscriptions are failing after upgrading to BeyondInsight version 24.2.1 KB0021720 - RDP connections in Password Safe fail to Windows Server 2000, 2003, 2008, 2008 R2, 2012, or 2012 R2 systems KB0021727 - How to troubleshoot delays when logging into Password Safe Cloud

Hi, is there a way to allow endusers to watch their own session recordings?I had a developer who wanted to review a 5 hour SSH session he ran to look foir a mistake, however I cant seem to find the function to enable it for him?

The following articles were published last week. New Knowledge Base Articles: KB0021620 - Is 24 hours the minimum time a password can be rotated? What options are available for changing password frequency? KB0021654 - Discovery issue for directory query - Error "Selected Smart Rule does not contain any scan targets" KB0021656 - Users with delegated access to Analyti

¿Is there any functionality to rotate passwords every set amount of time?Basically, we want the account “admin” rotate every hour, or every 8 hours. We only can see the time for “at least” 1 time in the day or multiple if the account rotates every check-in but no every hour lets say.HAve you encountered a customer that solicited this? How would you go about it? Many thanks!

Can BeyondInsight support LDAP for Role-Based Access? As we are unable to sync users once we have configured LDAP for authentication. we tried adding users through ldap in users and trying to authenticate, it does not work as well. Any guides or suggestions would be a great help

Functional Account test password is failing and so we are recieving the below error. Can anyone please help on this. Verify Managed Account on Active Directory system: Domain=UGNX.local, PreferredController=, UseSsl=True, EnforceCertificateValidation=True, Account=(AccountName=s_pr, DistinguishedName=, SamAccountName=s_pr, UserPrincipalName=s_pr@ugnx.local, DomainName=UGNX.local, Privilege=, SID=S-1-5-21-2902959944-561351360-3437842006-37045, DisableAtRest=False) FunctionalAccount=(AccountName=srv_BT_Win_FA, DistinguishedName=srv_BT_Win_FA, SamAccountName=srv_BT_Win_FA, UserPrincipalName=srv_BT_Win_FA@ugnx.local, DomainName=UGNX.local, Privilege=, SID=, DisableAtRest=False) Querying managed account attributes... Search attributes for SID=S-1-5-21-2902959944-561351360-3437842006-37045 ValidateActiveDirectoryCredentials - domain: 'UGNX.local'; username: 's_pr'; useSsl: 'True'; domainController: 'UGNX.local'. Ignore Errors=False, Trust First Certificate=False Subject=CN=U

Dear all, A question: The ssh authentication on MAC (MacOs) is working via BeyondInsight\Password. What are the settings for authentication in the Mac graphical interface via PAM?I received this information below, where my developer team said that they would like to perform this entire process via PS/BI:"In step 1 - SSH would be enough for developers to install tools that depend on the terminal and run the build of iOS apps and perhaps unit tests in previously configured projects. In a slightly more complicated way, it would also be possible to submit apps to the Apple store. This submission requires a MAC device and is usually done via xCODE or the Transporter app, which are visual, but it is possible to submit through the configuration of tools such as Fastlane.In step 2 - Some configurations of Apple's iOS projects need to be done via xCODE, which is essentially visual. Development and debugging via xCODE and simulation of apps in the iOS simulato

The following articles were published last week. New Knowledge Base Articles: KB0021387 - Unable to login to web console when user is in child domains - Logon user missing permissions and roles - Directory Queries do run against the parent domain KB0021502 - What best practices should be done for on-premise appliance implementation? KB0021630 - Password Safe SSH fai

how to onboard multiple ubuntu VM's over the XRDP

Hello, What is the list of reasons the PasswordSafe Session Manager utilizes high CPU, other than well known the SCP protocol issue in version 23?Because its often behavior in PasswordSafe and multiple customers are complaining about it.

I am trying to search accounts in Password Safe.  I am looking for accounts that are just admin but I have accounts that are netadmin as well that are showing.  Is there a way to do an exact match when searching in Password Safe?  I tried ‘admin’ and “admin” with no luck.